Static Kitten

Static Kitten, also known as MuddyWater, Mercury, Mango Sandstorm, and TA450, is an Iranian government-sponsored hacking group suspected to be linked to the Iranian Ministry of Intelligence and Security. The group has been active since 2017 and is notorious for its cyber-espionage activities. Static Kitten uses various tactics, such as spear-phishing campaigns, to infiltrate systems and steal sensitive information. In recent events, Static Kitten has targeted Israeli entities with a new spear-phishing campaign, distributing N-able's Advanced Monitoring Agent remote administration tool. In March 2024, Static Kitten launched a phishing campaign where they distributed two URLs via phishing emails, directing recipients to Onehub, a legitimate file storage service that Static Kitten is known to use for malicious purposes. These URLs led to ZIP files themed to be relevant to government agency employees. Anomali Threat Research confirmed that Static Kitten continues to use Onehub to host a file containing ScreenConnect, which is likely used to steal sensitive information or download malware for additional cyber operations. The delivery URLs found in this campaign were "ws.onehub[.]com/files/7w1372el" and "ws.onehub[.]com/files/94otjyvd". The phishing emails contained files with names translated as "Analysis and study of the normalization of relations between the Arab countries and Israel", "Scholarships", and "Project". The objective was to direct users to a downloader URL via a phishing email that impersonates an EXE file. Static Kitten's activities represent both a continuation and evolution of tactics used by similar groups such as APT34, also known as Cobalt Gypsy, OilRig, and Helix Kitten.