{"id":2563,"date":"2022-03-14T16:37:48","date_gmt":"2022-03-14T22:37:48","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=2563"},"modified":"2022-03-14T16:37:51","modified_gmt":"2022-03-14T22:37:51","slug":"the-muddywater-may-have-cleared-up-just-a-bit","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/03\/14\/the-muddywater-may-have-cleared-up-just-a-bit\/","title":{"rendered":"The “MuddyWater” May Have Cleared Up Just a Bit"},"content":{"rendered":"\n

As of late, it seems as though the frequency and prominence of cyber attacks has seen a rise globally. Now in an everchanging and technologically advancing civilization, this should come as no surprise. With that said however, it is still important to be made self-aware of the potential dangers and threats that exist, which leads into the topic of this blog post about MuddyWater.<\/p>\n\n\n\n

What is MuddyWater and what has it done?<\/h2>\n\n\n\n

MuddyWater, also sometimes known as “Mercury” or “Static Kitten”, is an Iranian state-sponsored threat actor, which has been active since at least 2017. In other words, they are a group of hackers who can be attributed to the Iranian government or, more specifically, Ministry of Intelligence and Security; working, in essence, for the sake of furthering the nation’s geopolitical objectives.<\/p>\n\n\n\n

In terms of what the group has done, they have been accredited as being the sole cause of cyber attacks on several government owned corporations; whether that may be through phishing tactics or malware. With the majority of these attacks happening within the Middle East and nearby Asian countries. Furthermore, it seems that the frequency of these attacks by the group has seen an increase especially within the past year of 2021, which does raise a few eyebrows out of concern.<\/p>\n\n\n\n

Why are they relevant?<\/h2>\n\n\n\n

For starters, a few weeks back in late February of 2022, warnings had been sent out against the group in response to these global cyber attacks which, as already mentioned, have been occurring more frequently. This in of itself should be cause for some concern, especially given current circumstances regarding the Russia and Ukraine conflicts, where, globally, political tensions are already high enough as is. <\/p>\n\n\n\n

More recently, however, the threat intelligence organization Cisco Talos has publicized their findings in regards to their tracing on the activities of the group, which has been happening for over a year now. In their research, it seems that they have traced several campaigns or cyber attacks back to MuddyWater, also analyzing the method of attack and the programming behind it. By doing so, Cisco Talos has deduced that MuddyWater is likely to be comprised of several subgroups, with each based in a different region, that share common interests; in opposition to one larger group who may be entirely based in Iran. A deduction, which potentially exposes the Iranian government, given that several of these cyber attacks that Cisco Talos has analyzed were previously blamed on Western nations for by the Iranian government themselves.<\/p>\n\n\n\n

\"\"
This diagram shows some similarities between past MuddyWater campaigns<\/figcaption><\/figure>\n\n\n\n

How might this impact the average citizen?<\/h2>\n\n\n\n

With the recent findings and deductions made, if these do turn out to be true, it certainly would not look good for the Iranian government, which could further damage already dwindling relationships between Iran and other Western nations. Additionally, should MuddyWater consist of several subgroups, it certainly has the potential to make the group a lot more dangerous than they currently are as it introduces the possibility of the group going more widespread than they are now, which may allow for a higher frequency of attacks within places such as North America, Europe, and the remaining parts of Asia as opposed to just the Middle East and places nearby. Not to mention that while the usual victims do tend to be governments or government owned corporations, the possibility that an average citizen also becomes a victim as a side effect always exists, especially given that they have used widespread scam tactics, such as phishing, before.<\/p>\n\n\n\n

References<\/h2>\n\n\n\n