Hacker Group 'Moses Staff' Using New StrifeWater RAT In Ransomware Attacks

 

A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.

Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."

"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."

Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.

The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.

To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.

The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.

The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.

StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.

"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."

More info

1. Pentest Tools Website
2. Hack Tool Apk
3. Hacking Tools Name
4. Pentest Tools Download
5. Hack Tools For Pc
6. Hack Tool Apk
7. Wifi Hacker Tools For Windows
8. Underground Hacker Sites
9. Tools 4 Hack
10. Pentest Recon Tools
11. Android Hack Tools Github
12. Pentest Tools Android
13. Tools For Hacker
14. Hacking Tools
15. Hack Tools
16. Hacking Tools Windows
17. Pentest Tools
18. Hack Tools 2019
19. Pentest Tools Website Vulnerability
20. Pentest Tools Nmap
21. Hack Tools Download
22. Best Pentesting Tools 2018
23. Hacking Tools Name
24. Kik Hack Tools
25. Hacking Tools Free Download
26. Pentest Tools For Mac
27. Tools For Hacker
28. How To Make Hacking Tools
29. Hacking Tools For Kali Linux
30. Pentest Tools Android
31. Best Pentesting Tools 2018
32. Hacking Tools Online
33. Hacking Tools For Windows
34. Game Hacking
35. Hack Tool Apk
36. Hack Tool Apk
37. Hacker Tools Hardware
38. Termux Hacking Tools 2019
39. Hacking Tools For Windows
40. Pentest Recon Tools
41. Hacker Security Tools
42. Hacking Tools For Kali Linux
43. Pentest Tools Github
44. Nsa Hack Tools
45. Pentest Tools Review
46. Hacker Tools 2020
47. Hacking Tools Windows
48. Hack Tool Apk
49. Beginner Hacker Tools
50. Pentest Tools Linux
51. Hacking Tools Usb
52. Hacking Tools For Kali Linux
53. Hacker Tools Apk
54. Hacking Tools For Games
55. Hack Website Online Tool
56. Pentest Tools Alternative
57. Hacking Tools Download
58. Hack Tools Pc
59. Hacker Tools For Mac
60. Hacker
61. Hacker Search Tools
62. Pentest Tools Kali Linux
63. Hack Tools For Windows
64. Hacker Tools List
65. Pentest Tools Alternative
66. Pentest Tools
67. Hacker Hardware Tools
68. Hacker Tools For Mac
69. Kik Hack Tools
70. Pentest Tools Android
71. Hacking Tools Free Download
72. Ethical Hacker Tools
73. Hacking App
74. Pentest Box Tools Download
75. Termux Hacking Tools 2019
76. Hacking App
77. Hacker Search Tools
78. Hack Tools For Pc
79. Pentest Recon Tools
80. Hacker Tools For Ios
81. Hacker
82. Best Hacking Tools 2020
83. Hacking Tools Hardware
84. Best Hacking Tools 2019
85. Hack Tools
86. Hacking Tools For Pc
87. Hack Tools
88. Hacker Tools For Ios
89. Hacker Tools Mac
90. Pentest Tools Bluekeep
91. Hacking Tools Usb
92. Hacker Tools Mac
93. Beginner Hacker Tools
94. Free Pentest Tools For Windows
95. Hacker Tools For Windows
96. Hack Website Online Tool
97. Pentest Tools Bluekeep
98. Kik Hack Tools
99. Hacking Tools For Pc
100. Free Pentest Tools For Windows
101. Pentest Tools Tcp Port Scanner
102. Hacking Tools For Windows Free Download
103. Hacker Tools Software
104. Pentest Tools Kali Linux
105. Best Hacking Tools 2019
106. Hack Tools Pc