Do Son Rapid7 unmasks Iranian APT MuddyWater using a Chaos ransomware "false flag" to hide state-sponsored espionage. See how they bypassed MFA via MS Teams.
Iran APT
Hunt Intelligence uncovers a massive Iranian-nexus breach targeting the Omani Ministry of Justice. 26k records leaked via an unprotected UAE staging server.
Mandiant exposed UNC1549, an Iranian APT, using DLL search order hijacking on Citrix/VMware to deploy TWOSTROKE and DCSYNCER.SLICK. The group performs VDI breakouts for long-term espionage.
Group-IB exposed MuddyWater using NordVPN to send phishing emails that deliver the Phoenix v4 backdoor. The malware steals credentials via a custom Chromium stealer disguised as a calculator.