MuddyWater eN-Able spear-phishing with new TTPs
released on 2023-11-03 @ 04:47:52 PM
Previous research showed that MuddyWater has sent spear-phishing emails, starting back in 2020, with direct links, as well as PDF, RTF, and HTML attachments containing links to archives hosted on various file-sharing platforms.
Those archives contained installers for various legitimate remote administration tools.
Before launching the new campaign during the Israel-Hamas war, MuddyWater reused previously known remote administration tools, utilizing a new file-sharing service called “Storyblok.”