Seedworm

Seedworm, also known as MuddyWater, TEMP.Zagros, Static Kitten, and several other monikers, is a threat actor believed to be linked with Iran's Ministry of Intelligence and Security (MOIS). This cyberespionage group has been active since 2017, targeting various sectors globally, including government agencies, oil & gas, NGOs, telecoms, and IT firms. Over the years, Seedworm has compromised more than 130 victims across 30 organizations, with a particular focus on entities in Egypt, Sudan, Tanzania, and Israel. The group employs a variety of tools, including the SimpleHelp remote access tool, Venom Proxy, a custom keylogger, and other publicly available and living-off-the-land tools. In March 2024, Proofpoint researchers observed Seedworm conducting a new phishing campaign targeting Israeli entities. This campaign sought to install a legitimate Remote Monitoring and Management (RMM) solution called Atera onto target systems, providing the attackers with extensive access and control. Symantec noted multiple incidents where Seedworm used SimpleHelp to connect to its known infrastructure, executing a custom build of the Venom Proxy hacktool and a new custom keylogger on the network. The first signs of malicious activity typically come from the execution of PowerShell code to connect to a command-and-control (C2) framework called MuddyC2Go, an infrastructure previously linked to Seedworm. An executable fitted with a PowerShell script automatically connects to Seedworm's C2 server, giving the attackers remote access to a victim system without the need for manual execution by an operator. Researchers believe this framework may have been in use by Seedworm since 2020. As such, Seedworm poses a significant ongoing threat to targeted sectors and regions, warranting continued vigilance and robust cybersecurity measures.