MuddyWater Hackers Using UDPGangster Backdoor to Attack Windows Systems Evading Network Defenses
A new cyber threat has been identified, targeting Windows systems in various Middle Eastern countries.
A new cyber threat has been identified, targeting Windows systems in various Middle Eastern countries.
The malware, known as UDPGangster, is a UDP-based backdoor utilized by the MuddyWater threat group, which is renowned for its cyber espionage activities in the Middle East and surrounding regions.
This backdoor affords attackers full remote access to compromised systems, enabling them to execute commands, exfiltrate files, and deploy additional malware through UDP channels designed to bypass conventional network security protocols.
Recent attack campaigns have been reported in Turkey, Israel, and Azerbaijan.
The attack strategy involves the use of malicious Microsoft Word documents embedded with macros as the primary delivery method.
When users enable macros, the backdoor is installed silently, granting attackers access to sensitive information and critical infrastructure.
A new cyber threat has been identified, targeting Windows systems in various Middle Eastern countries.
Social Engineering and Phishing Tactics
The campaigns employ advanced social engineering techniques, with phishing emails impersonating government entities.
For instance, one campaign claimed to be from the Turkish Republic of Northern Cyprus Ministry of Foreign Affairs, inviting recipients to an online seminar.
The documents contain seemingly harmless information to distract users while malicious code executes in the background.
Infection Mechanism and Anti-Analysis Evasion
The infection process is initiated once phishing emails containing Microsoft Word documents with embedded VBA macros are opened, and the macros are enabled.
The Document_Open() event triggers the backdoor installation by decoding Base64-encoded data from a hidden form field and writing it to C:\Users\Public\ui.txt.
This file is executed using Windows API functions, specifically CreateProcessA, which loads the UDPGangster payload into system memory.
Persistence is achieved by copying the malware to %AppData%\RoamingLow as SystemProc.exe and modifying the Windows registry to ensure it runs at startup.
The malware utilizes nine anti-analysis techniques to evade detection, including debugger detection, CPU checks, memory and disk verification, MAC address analysis, hardware inspection, and sandbox detection.
After evading security measures, UDPGangster collects system information and sends it to command-and-control servers at 157.20.182.75 over UDP port 1269.
Based on reporting by Cyber Security News.
