TA450 Shifts Tactics in Latest Phishing Campaign Targeting Israeli Sectors
- Actor Motivations: Espionage
- Attack Vectors: RAT,Phishing,Spear Phishing
- Attack Complexity: Medium
- Threat Risk: High Impact/High Probability
Threat Overview
The Iran-aligned threat actor TA450, also known as MuddyWater, has launched a phishing campaign targeting Israeli employees in global manufacturing, technology, and information security sectors. Using pay-related social engineering lures, the campaign, active since early March 2024, features emails with PDF attachments containing malicious links. These links lead to the download of a ZIP file that installs AteraAgent, a piece of remote administration software abused by TA450. This campaign marks a shift in TA450's tactics, notably using PDF attachments for malicious link delivery and compromised Israeli email accounts matching the lure content, highlighting an increased risk for targeted multinational companies.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Sector | Information Technology | Verified |
| Sector | Manufacturing | Verified |
| Region | Israel | Verified |
Extracted IOCs
- cc4cc20b558096855c5d492f7a79b160a809355798be2b824525c98964450492
- dee6494e69c6e7289cf3f332e2867662958fa82f819615597e88c16c967a25a9
- e89f48a7351c01cbf2f8e31c65a67f76a5ead689bb11e9d4918090a165d4425f
Tip: 3 related IOCs (0 IP, 0 domain, 0 URL, 0 email, 3 file hash) to this threat have been found.
Overlaps
Source: HarfangLab - April 2024
Detection (two cases): cc4cc20b558096855c5d492f7a79b160a809355798be2b824525c98964450492, e89f48a7351c01cbf2f8e31c65a67f76a5ead689bb11e9d4918090a165d4425f
Source: Malwation - March 2024
Detection (two cases): cc4cc20b558096855c5d492f7a79b160a809355798be2b824525c98964450492, e89f48a7351c01cbf2f8e31c65a67f76a5ead689bb11e9d4918090a165d4425f
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.
FAQs
TA450 Phishing Campaign Targeting Multinational
Recently, a cyberattack campaign was discovered that uses fake payroll and salary emails to trick employees into downloading malicious software. Attackers sent emails containing a PDF attachment, and clicking a link inside that PDF ultimately installed a remote management tool on the victim's computer. This allowed the attackers to gain unauthorized access to the infected systems.
The attack was carried out by a group known as TA450, which is also tracked under the names MuddyWater, Mango Sandstorm, and Static Kitten. The United States Cyber Command has attributed this specific group to Iran's Ministry of Intelligence and Security.
The goal of the attack is to quietly install remote administration software on an employee's computer. Once this software is installed, the attackers can securely control the computer from afar, allowing them to monitor activities, steal information, or navigate further into the company's network.
The campaign specifically targeted Israeli employees working at large multinational organizations. The attackers focused primarily on companies within the global manufacturing, technology, and information security industries.
Yes, the attackers highly customized their approach by using Hebrew-language emails and compromised local email accounts. They specifically targeted Israeli individuals by preying on natural employee interest in compensation and payroll updates.
The attackers sent deceptive salary-themed emails from legitimate-looking accounts. When a victim opened the attached PDF and clicked the link inside, it downloaded a file from a standard file-sharing website. Opening that downloaded file secretly installed the attackers' remote control software.
This activity continues a trend that began in October 2023 at the start of the Israel-Hamas war. Israeli individuals and multinational organizations with a footprint in the region represent high-value targets for Iranian-aligned groups looking to gather intelligence or disrupt operations.
This is a highly targeted threat. The attackers are not sending these emails randomly across the internet; they are carefully selecting specific individuals at specific multinational companies and using tailored language and relevant scenarios to increase their chances of success.
Organizations should review their networks for any unauthorized use of remote administration tools like AteraAgent. Employees should remain highly cautious of any unexpected emails regarding their salary or compensation, particularly if the email asks them to open a PDF or download a file from a third-party website.