Written by AJ Vicens
Dec 14, 2021 | CYBERSCOOP
Hackers targeted a string of telecommunication operators and IT service organizations in the Middle East and Asia over the last six months, according to research published Tuesday.
The suspected espionage activity targeted organizations in Israel, Jordan, Kuwait, Saudi Arabia, the United Arab Emirates, Pakistan, Thailand, and Laos, according to the research from Symantec’s Threat Hunter Team. The “targeting and tactics are consistent with Iranian-sponsored actors,” researchers noted, but stopped short of tying the activity to the Iranian government.
Some of the evidence shows a link to Seedworm — otherwise known as MuddyWater — a prolific hacking group with suspected ties to Iran known for concerted espionage efforts dating back to at least 2015. The group previously threatened to kill security researchers who stumbled across one of its command-and-control servers. Its operators have also focused on academia and the tourism industry in multiple countries earlier this year, and governments and other telecommunications operators over the last several years.
Symantec researchers noted that the latest activity shows attackers relying on a mixture of legitimate remote administration and security assessment tools, publicly available malware, and no apparent use of custom malware. After breaching
Read More: https://www.cyberscoop.com/new-iranian-hacking-activity-muddywater-seedworm/
