“” ), tsundere deno malware ( “ dindoor ” ), and castleloader ( “ fakeset ” ) variants. in our assessment, this does not necessarily indicate that muddywater is a castleloader affiliate ; rather, it suggests that both may have obtained certificates from the same source. iranian qi…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1204.002Malicious File
61%
“related. this demonstrates that the use of criminal software can be effective for obfuscation, and highlights the need for extreme caution when analyzing overlapping clusters. to address this, we attempted to bring structure to the available evidence, to the best of our ability, …”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1588.001Malware
60%
“” ), tsundere deno malware ( “ dindoor ” ), and castleloader ( “ fakeset ” ) variants. in our assessment, this does not necessarily indicate that muddywater is a castleloader affiliate ; rather, it suggests that both may have obtained certificates from the same source. iranian qi…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
T1553.002Code Signing
34%
“##water uses the botnet as part of its operations. another overlap between dindoor - related activity and known muddywater tradecraft is the use of rclone to access a wasabi server, which traces back to an ip address previously associated with muddywater ( 18. 223. 24 [. ] 218, l…”
Which technique(s) should be tagged here? Pick zero or more — leaving blank just records that the original was wrong.
No matches for .
Loading techniques…
Summary
Key Points Iran-linked actors are increasingly engaging with the cyber crime ecosystem. Their activity suggests a growing reliance on criminal tools, services, and operational models in support of state objectives. Iranian actors have long used cyber crime and hacktivism as cover for destructive activity, but the trend now suggests direct engagement with the criminal ecosystem. […]