Discover and read the best of Twitter Threads about #MuddyWater
Most recents (3)
1/ New #MuddyWater 🇮🇷Infra detected; moves to #Metasploit and #HPAnywhere/#Teradici tool added?
@GroupIB_TI released a great report detailing MuddyWater’s use of SimpleHelp Remote Support Software. They tracked the #APT's infrastructure using Etags.
Let's take a look! 🧐 👇👇
@GroupIB_TI released a great report detailing MuddyWater’s use of SimpleHelp Remote Support Software. They tracked the #APT's infrastructure using Etags.
Let's take a look! 🧐 👇👇
2/ First Etag(153): 🔟results.
First IP of interest: 👉164.132.237[.]67
If we now pivot on the SSH hash, we match on another IP:
👉3.6.222[.]144.
Looking at this IP, the SSL certificate presented mentions O=Teradici Corporation...
First IP of interest: 👉164.132.237[.]67
If we now pivot on the SSH hash, we match on another IP:
👉3.6.222[.]144.
Looking at this IP, the SSL certificate presented mentions O=Teradici Corporation...
3/ Teradici (now HP Anywhere) allows for remote access to machines from any PCoIP client. 💻⬅️🌐⬅️💻
Indicating that MuddyWater may also be using HP’s Anywhere/Teradici as well as SimpleHelp?🧐
Indicating that MuddyWater may also be using HP’s Anywhere/Teradici as well as SimpleHelp?🧐
Correlation or causation? 1>A friend who's a notary watches you, your #hoochiecoochie, & 2 other friends sign your marriage license between classes. 2>You celebrate the 18th anniversary of a #HappyMarriage that's withstood #bangBANGkaBOOM daily #migraine.
#JamesCotton plays harp on Muddy's Hoochie Coochie. We opened for Cotton when he toured his 1996 Grammy-winning solo album. I only played the 1st set. We were on break when Cotton came in & I handed off my #bass so I could hang out with--are you kidding?--James COTTON. #blues
I can't tweet #MuddyWater's Hoochie Coochie without tweeting #WillieDixon's original. He wrote it in 1954. #blues
In response to increased U.S.-Iran tensions & concerns of retaliatory cyber attacks, Iranian intrusion experts @sj94356 & @QW5kcmV3 are on #StateOfTheHack for the latest on all things Iran: #APT33 #APT34 #APT35 #APT39 #MuddyWater & active UNC groups 🇮🇷👨💻🕵️♂️
@sj94356 @QW5kcmV3 Wait, did @YouTube remove the #StateOfTheHack episode? 👉feye.io/soth 👀
Are we being oppressed? Do they think this is a U.S.-Iran influence operation? ... is it? 🇺🇸🇮🇷Am I going to get a bunch of weird #MAGA replies to this tweet? I have so many questions 😅🙃
Are we being oppressed? Do they think this is a U.S.-Iran influence operation? ... is it? 🇺🇸🇮🇷Am I going to get a bunch of weird #MAGA replies to this tweet? I have so many questions 😅🙃
For more information on mitigations as well as our public source material supporting the discussion from the show, please check out:
• APT33 graduation: fireeye.com/blog/threat-re…
brighttalk.com/webcast/10703/…
• APT33 webinar & examples: fireeye.com/blog/threat-re…
... (more below)
• APT33 graduation: fireeye.com/blog/threat-re…
brighttalk.com/webcast/10703/…
• APT33 webinar & examples: fireeye.com/blog/threat-re…
... (more below)
