Iran state-sponsored threat group MuddyWater, also known as Mercury, Cobalt Ulster, TEMP.Zagros, Yellow Nix, Static Kitten, Earth Vetala, Boggy Serpens, and ITG17, has been collaborating with DEV-1084 in launching attacks against on-premises and cloud infrastructures in a fashion similar to a ransomware campaign, although the attacks were intended to be disruptive and destructive, according to The Hacker News. “Mercury likely exploited known vulnerabilities in unpatched applications for initial access before handing off access to DEV-1084 to perform extensive reconnaissance and discovery, establish persistence, and move laterally throughout the network, oftentimes waiting weeks and sometimes months before progressing to the next stage,”

Read full article on SC Magazine