Hacker Group 'Moses Staff' Using New StrifeWater RAT In Ransomware Attacks

 

A politically motivated hacker group tied to a series of espionage and sabotage attacks on Israeli entities in 2021 incorporated a previously undocumented remote access trojan (RAT) that masquerades as the Windows Calculator app as part of a conscious effort to stay under the radar.

Cybersecurity company Cybereason, which has been tracking the operations of the Iranian actor known as Moses Staff, dubbed the malware "StrifeWater."

"The StrifeWater RAT appears to be used in the initial stage of the attack and this stealthy RAT has the ability to remove itself from the system to cover the Iranian group's tracks," Tom Fakterman, Cybereason security analyst, said in a report. "The RAT possesses other capabilities, such as command execution and screen capturing, as well as the ability to download additional extensions."

Moses Staff came to light towards the end of last year when Check Point Research unmasked a series of attacks aimed at Israeli organizations since September 2021 with the objective of disrupting the targets' business operations by encrypting their networks, with no option to regain access or negotiate a ransom.

The intrusions were notable for the fact that they relied on the open-source library DiskCryptor to perform volume encryption, in addition to infecting the systems with a bootloader that prevents them from starting without the correct encryption key.

To date, victims have been reported beyond Israel, including Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.

The new piece of the attack puzzle discovered by Cybereason comes in the form of a RAT that's deployed under the name "calc.exe" (the Windows Calculator binary) and is used during the early stages of the infection chain, only to be removed prior to the deployment of the file-encrypting malware.

The removal and the subsequent replacement of the malicious calculator executable with the legitimate binary, the researchers suspect, is an attempt on the part of the threat actor to cover up tracks and erase evidence of the trojan, not to mention enable them to evade detection until the final phase of the attack when the ransomware payload is executed.

StrifeWater, for its part, is no different from its counterparts and comes with numerous features, chief among them being the ability to list system files, execute system commands, take screen captures, create persistence, and download updates and auxiliary modules.

"The end goal for Moses Staff appears to be more politically motivated rather than financial," Fakterman concluded. "Moses Staff employs ransomware post-exfiltration not for financial gain, but to disrupt operations, obfuscate espionage activity, and to inflict damage to systems to advance Iran's geopolitical goals."

More articles

1. New Hacker Tools
2. Nsa Hack Tools
3. Tools For Hacker
4. Pentest Tools Alternative
5. Hack Tools Mac
6. Hack Tools
7. Hak5 Tools
8. Pentest Box Tools Download
9. Hack Tools Github
10. Hak5 Tools
11. Physical Pentest Tools
12. Hacker Tools For Mac
13. Pentest Tools Free
14. Hacker Hardware Tools
15. Hack Tools 2019
16. Underground Hacker Sites
17. Pentest Tools Apk
18. Pentest Tools Kali Linux
19. Wifi Hacker Tools For Windows
20. Growth Hacker Tools
21. Tools For Hacker
22. Install Pentest Tools Ubuntu
23. Hack Tools Online
24. Pentest Tools Tcp Port Scanner
25. Hacking Tools Hardware
26. Hacking Tools For Windows 7
27. Kik Hack Tools
28. Hacking Tools Windows
29. Beginner Hacker Tools
30. Hackrf Tools
31. Hacker Tools Apk Download
32. Hacker Tools List
33. Hacking Tools Github
34. Hack Tools
35. Nsa Hack Tools Download
36. Pentest Box Tools Download
37. Pentest Recon Tools
38. Tools Used For Hacking
39. Pentest Tools For Ubuntu
40. Hack App
41. Hack Tools Download
42. Hacking Tools Name
43. Hack Tools For Windows
44. Pentest Tools Alternative
45. Hacker Tools Free Download
46. Pentest Tools Android
47. Hacking Tools For Beginners
48. Hackrf Tools
49. Hacking Tools Pc
50. Pentest Recon Tools
51. Hacker Tools Windows
52. Hacking Tools Mac
53. Underground Hacker Sites
54. New Hacker Tools
55. Tools 4 Hack
56. Hacks And Tools
57. Hacker Tools For Ios
58. Hacking Tools For Pc
59. Hacker Tools Windows
60. Hacker Tools Windows
61. Hacker Tools For Ios
62. Github Hacking Tools
63. Hacker Techniques Tools And Incident Handling
64. Pentest Tools Online
65. Hacking Tools Hardware
66. Hacking Tools For Windows 7
67. Hacking App
68. Best Pentesting Tools 2018
69. Pentest Tools Online
70. Hack Apps
71. Pentest Tools Nmap
72. Hacker Tools List
73. Hacking Tools Github
74. Pentest Tools Nmap
75. Hacker Search Tools
76. Tools For Hacker
77. Hacker Tools For Mac
78. Free Pentest Tools For Windows
79. Nsa Hack Tools
80. Game Hacking
81. Hack Tools
82. Underground Hacker Sites
83. Nsa Hacker Tools
84. Pentest Tools Find Subdomains
85. Hack Tools For Windows
86. Kik Hack Tools
87. Physical Pentest Tools
88. Hacking Tools For Windows
89. Termux Hacking Tools 2019
90. Hacking Tools Online
91. Pentest Tools Website Vulnerability
92. Hacking Tools Github
93. Pentest Tools
94. Pentest Tools Port Scanner
95. Hacker Tools For Ios
96. Pentest Tools Linux
97. Hacking Tools Kit
98. Hacking Tools
99. Pentest Tools Alternative
100. Hacks And Tools
101. Hack Tools Github
102. Hacker Tool Kit
103. Pentest Tools Android
104. Hacking App
105. Computer Hacker
106. Hacking Tools Free Download
107. Nsa Hacker Tools
108. Pentest Tools List
109. Bluetooth Hacking Tools Kali
110. Hacker Tools 2019
111. Hack Tools Online
112. Pentest Tools Bluekeep
113. Hacker Tools List
114. Hacking Tools Free Download
115. Hacking Tools For Mac
116. What Is Hacking Tools
117. Hacking Tools Download
118. Tools For Hacker
119. Hackers Toolbox
120. Hack Tools Download
121. Nsa Hack Tools Download
122. New Hack Tools
123. Hacker Tools
124. Pentest Box Tools Download
125. Tools Used For Hacking
126. Hacker Tools Free Download
127. Hacking Tools For Kali Linux
128. Pentest Tools Kali Linux
129. Pentest Recon Tools
130. Pentest Tools Nmap
131. Hacker Hardware Tools