Hacker Group ‘Moses Staff’ Using New StrifeWater RAT in Ransomware Attacks

A politically motivated hacker group tied to a series of
espionage and sabotage attacks on Israeli entities in 2021
incorporated a previously undocumented remote access trojan (RAT)
that masquerades as the Windows Calculator app as part of a
conscious effort to stay under the radar.

Cybersecurity company Cybereason, which has been tracking the
operations of the Iranian actor known as Moses Staff, dubbed the
malware “StrifeWater.”

“The StrifeWater RAT appears to be used in the initial stage of
the attack and this stealthy RAT has the ability to remove itself
from the system to cover the Iranian group’s tracks,” Tom
Fakterman, Cybereason security analyst, said^[1]
in a report. “The RAT possesses other capabilities, such as command
execution and screen capturing, as well as the ability to download
additional extensions.”

Moses Staff came to light towards the end of last year when
Check Point Research unmasked^[2]
a series of attacks aimed at Israeli organizations since September
2021 with the objective of disrupting the target’s business
operations by encrypting their networks, with no option to regain
access or negotiate a ransom.

The intrusions were notable for the fact that they relied on the
open-source library DiskCryptor to perform volume encryption, in
addition to infecting the systems with a bootloader that prevents
them from starting without the correct encryption key.

To date, victims have been reported beyond Israel, including
Italy, India, Germany, Chile, Turkey, the U.A.E., and the U.S.

The new piece of the attack puzzle discovered by Cybereason
comes in the form of a RAT that’s deployed under the name
“calc.exe” (the Windows Calculator binary) and is used during the
early stages of the infection chain, only to be removed prior to
the deployment of the file-encrypting malware.

The removal and the subsequent replacement of the malicious
calculator executable with the legitimate binary, the researchers
suspect, is an attempt on the part of the threat actor to cover up
tracks and erase evidence of the trojan, not to mention enable them
to evade detection until the final phase of the attack when the
ransomware payload is executed.

StrifeWater, for its part, is no different from its counterparts
and comes with numerous features, chief among them being the
ability to list system files, execute system commands, take screen
captures, create persistence, and download updates and auxiliary
modules.

“The end goal for Moses Staff appears to be more politically
motivated rather than financial,” Fakterman concluded. “Moses Staff
employs ransomware post-exfiltration not for financial gain, but to
disrupt operations, obfuscate espionage activity, and to inflict
damage to systems to advance Iran’s geopolitical goals.”