{"id":25634,"date":"2025-01-02T07:21:25","date_gmt":"2025-01-02T15:21:25","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2025\/01\/02\/news-19357\/"},"modified":"2025-01-02T07:21:25","modified_gmt":"2025-01-02T15:21:25","slug":"news-19357","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2025\/01\/02\/news-19357\/","title":{"rendered":"Sophos MDR bloque et suit les activit\u00e9s du probable acteur \u00e9tatique iranien &#8220;MuddyWater&#8221;"},"content":{"rendered":"<p><strong>Credit to Author: gallagherseanm| Date: Mon, 25 Nov 2024 20:41:20 +0000<\/strong><\/p>\n<div class=\"entry-content lg:prose-lg mx-auto prose max-w-4xl\">\n<p>Nous pensons avec une confiance mod\u00e9r\u00e9e que cette activit\u00e9, que nous suivons sous le nom de <em>STAC 1171<\/em>, est li\u00e9e \u00e0 un <a href=\"https:\/\/news.sophos.com\/fr-fr\/category\/security-operations\/\" target=\"_blank\" rel=\"noopener\">acteur malveillant<\/a> iranien commun\u00e9ment appel\u00e9 <strong>MuddyWater<\/strong> ou <strong>TA450<\/strong>.<\/p>\n<p>Le premier incident que nous avons observ\u00e9 s\u2019est produit plus t\u00f4t en novembre, lorsque les r\u00e8gles comportementales de Sophos endpoint ont bloqu\u00e9 l\u2019activit\u00e9 de r\u00e9cup\u00e9ration d\u2019identifiants ciblant une organisation en Isra\u00ebl. Lors de l&#8217;analyse de l&#8217;activit\u00e9 en question, nous avons constat\u00e9 un <em>overlap<\/em> au niveau des indicateurs et TTP avec les <a href=\"https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign\" target=\"_blank\" rel=\"noopener\">rapports de Proofpoint<\/a> concernant TA450. L&#8217;acteur a obtenu un premier acc\u00e8s via un email de phishing demandant \u00e0 l&#8217;utilisateur d&#8217;ouvrir un document partag\u00e9 h\u00e9berg\u00e9 sur <em>hxxps[:\/\/]ws[.]onehub[.]com\/files\/<\/em> et de t\u00e9l\u00e9charger un fichier nomm\u00e9 &#8220;<em>New Program ICC LTD.zip<\/em>&#8220;.<\/p>\n<p><a href=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-958591\" src=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-1.png?w=640\" alt=\"sophos mdr\" width=\"469\" height=\"282\" srcset=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-1.png 1200w, https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-1.png?resize=300,181 300w, https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-1.png?resize=768,463 768w, https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-1.png?resize=1024,617 1024w\" sizes=\"auto, (max-width: 469px) 100vw, 469px\" \/><\/a><\/p>\n<p style=\"text-align: center\"><em>Figure 1 : Le site de partage de documents utilis\u00e9 pour diffuser le binaire Atera de l\u2019adversaire<\/em><\/p>\n<p>L\u2019archive &#8220;<em>New Program ICC LTD.zip<\/em>&#8221; contenait un fichier d\u2019installation compress\u00e9 pour l\u2019outil RMM (<em>Remote Machine Management<\/em>) l\u00e9gitime nomm\u00e9 Atera. L&#8217;installation d&#8217;Atera a utilis\u00e9 un compte de test enregistr\u00e9 avec une adresse email qui, selon nous, a \u00e9t\u00e9 compromise. Lors de l&#8217;installation de l&#8217;agent Atera, les acteurs malveillants ont utilis\u00e9 les commandes d&#8217;ex\u00e9cution \u00e0 distance d&#8217;Atera pour ex\u00e9cuter un script <em>PowerShell (a.ps1)<\/em> dans le but de r\u00e9cup\u00e9rer les identifiants et de cr\u00e9er un fichier de sauvegarde de la ruche du registre SYSTEM. Cette activit\u00e9 de r\u00e9cup\u00e9ration d\u2019identifiants a \u00e9t\u00e9 d\u00e9tect\u00e9e et bloqu\u00e9e par les r\u00e8gles comportementales de Sophos :<\/p>\n<blockquote>\n<p><em>\u201ccmdline\u201d: \u201cC:WINDOWSsystem32reg.exe\u201d save HKLMSYSTEM SystemBkup.hiv\u201d<\/em><\/p>\n<\/blockquote>\n<p><a href=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-958592\" src=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-2.png?w=640\" alt=\"sophos mdr\" width=\"640\" height=\"78\" srcset=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-2.png 5183w, https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-2.png?resize=300,36 300w, https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-2.png?resize=768,93 768w, https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-2.png?resize=1024,124 1024w, https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-2.png?resize=1536,187 1536w, https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr-2.png?resize=2048,249 2048w\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" \/><\/a><\/p>\n<p style=\"text-align: center\"><em>Figure 2 : Lignes de commande ex\u00e9cut\u00e9es par l&#8217;outil Atera RMM<\/em><\/p>\n<p>Les actions post compromission d\u2019Atera comprenaient \u00e9galement :<\/p>\n<ul>\n<li>Des commandes d&#8217;\u00e9num\u00e9ration de domaines multiples.<\/li>\n<li>Un tunnel SSH vers <em>51.16.209[.]105<\/em>.<\/li>\n<li>Une commande PowerShell obfusqu\u00e9e utilis\u00e9e pour t\u00e9l\u00e9charger l&#8217;outil Level RMM (au niveau de <em>hxxps[:]\/\/downloads.level.io\/install_windows.exe<\/em>).<\/li>\n<\/ul>\n<p>Nous avons vu la t\u00e9l\u00e9m\u00e9trie d&#8217;un autre client Sophos non-MDR aux \u00c9tats-Unis qui affiche le m\u00eame comportement. Sophos X-Ops continuera de surveiller cette activit\u00e9 et mettra \u00e0 jour toute information suppl\u00e9mentaire sur ce cluster de menaces.<\/p>\n<h2>Remerciements<\/h2>\n<p>Sophos X-Ops remercie Joshua Rawles, Hristina Ivanova et Mark Parsons pour leur travail sur cette chasse aux menaces et leurs contributions \u00e0 ce rapport.<\/p>\n<p>Billet inspir\u00e9 de <a href=\"https:\/\/news.sophos.com\/en-us\/2024\/11\/20\/sophos-mdr-blocks-and-tracks-activity-from-probable-iranian-state-actor-muddywater\/\" target=\"_blank\" rel=\"noopener\">Sophos MDR blocks and tracks activity from probable Iranian state actor \u201cMuddyWater\u201d<\/a>, sur le Blog Sophos.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.sophos.com\/fr-fr\/2024\/11\/25\/sophos-mdr-bloque-suit-activites-probable-acteur-etatique-iranien-muddywater\/\" target=\"bwo\" >http:\/\/feeds.feedburner.com\/sophos\/dgdY<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2024\/11\/sophos-mdr.png\"\/><\/p>\n<p><strong>Credit to Author: gallagherseanm| Date: Mon, 25 Nov 2024 20:41:20 +0000<\/strong><\/p>\n<p>Sophos MDR a observ\u00e9 une nouvelle campagne qui utilise le phishing cibl\u00e9 pour inciter les victimes potentielles \u00e0 t\u00e9l\u00e9charger un outil RMM (Remote Machine Management) l\u00e9gitime afin de r\u00e9cup\u00e9rer des identifiants.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10377],"tags":[24552,16771],"class_list":["post-25634","post","type-post","status-publish","format-standard","hentry","category-security","category-sophos","tag-security-operations","tag-threat-research"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/25634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=25634"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/25634\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=25634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=25634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=25634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}