Full Report
The Iranian hacking group known as MuddyWater has been observed leveraging a new backdoor dubbed UDPGangster that uses the User Datagram Protocol (UDP) for command-and-control (C2) purposes. The cyber espionage activity targeted users in Turkey, Israel, and Azerbaijan, according to a report from Fortinet FortiGuard Labs. "This malware enables remote control of compromised systems by allowing
Analysis Summary
# Threat Actor: MuddyWater
## Attribution & Identity
**Attribution:** Iranian hacking group.
**Known Aliases and Associated Groups:** Associated with previous activity delivering the MuddyViper backdoor.
## Activity Summary
MuddyWater has been observed leveraging a new backdoor named **UDPGangster** in a recent cyber espionage campaign. This activity specifically targeted users/entities in Turkey, Israel, and Azerbaijan. The campaign utilized spear-phishing to distribute malicious Microsoft Word documents attached within ZIP archives (e.g., "seminer.zip" containing "seminer.doc"). The emails reportedly impersonated the Turkish Republic of Northern Cyprus Ministry of Foreign Affairs, inviting recipients to an online seminar. If macros are enabled, initial execution leads to the deployment of the UDPGangster payload.
## Tactics, Techniques & Procedures
- **Initial Access:** Spear-phishing via malicious Microsoft Word documents delivered in archives.
- **Execution:** Exploiting the Document\_Open() event in VBA to decode and execute a payload from a hidden form field (Base64 encoded data written to `C:\Users\Public\ui.txt`).
- **Defense Evasion/Persistence:** UDPGangster establishes persistence via Windows Registry modifications.
- **Deception:** The VBA script displays a Hebrew-language decoy image from Bezeq (an Israeli telecom) regarding supposed service disconnections to conceal malicious activity.
- **Evasion:** Extensive anti-analysis routines are employed, including checking for debugging, VM/sandbox indicators (RAM size checks, registry scans, specific process termination, MAC address prefix validation), and domain/workgroup status.
- **Command and Control (C2):** Utilizes the User Datagram Protocol (UDP).
- **Action on Objectives:** Remote command execution (`cmd.exe`), file exfiltration, dropping/executing additional payloads, and C2 server updates.
## Targeting
- **Sectors:** The summary indirectly points to espionage targets but a related activity mentions ESET attributing attacks against academia, engineering, local government, manufacturing, technology, transportation, and utilities sectors in Israel.
- **Geography:** Turkey, Israel, and Azerbaijan.
- **Victims:** Not specifically named, but organizations in the above countries and sectors are implied targets of the cyber espionage activity.
## Tools & Infrastructure
- **Malware Families Used:** UDPGangster (new backdoor), VBA droppers.
- **Infrastructure (C2, domains, IPs):** C2 server IP address observed: `157.20.182[.]75` (UDP port 1269).
## Implications
The deployment of UDPGangster signifies MuddyWater's continued evolution, specifically in developing C2 mechanisms that leverage unusual protocols like UDP to evade detection by traditional, signature-based network defenses focused on common protocols (TCP/HTTP/S). The extensive anti-analysis routines indicate sophistication aimed at hindering forensic analysis.
## Mitigations
- Remain cautious of unsolicited documents, particularly those requesting macro activation.
- Organizations should focus detection capabilities on anomalous UDP traffic patterns, especially those originating from internal hosts communicating with known C2 infrastructure or unusual external IPs on non-standard ports.
- Implement robust endpoint detection and response (EDR) capable of detecting suspicious process injection stemming from document execution and registry modifications for persistence.