MITRE ATT&CKsoftware (malware)
S1047 Mori
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2022-09-30
Description
Mori is a backdoor that has been used by MuddyWater since at least January 2022.
Related
Uses · MITRE ATT&CK (9)
- T1001.001 Junk Data sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1132.001 Standard Encoding sub-technique
- T1070.004 File Deletion sub-technique
- T1218.010 Regsvr32 sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1012 Query Registry technique
- T1112 Modify Registry technique
Referenced by MITRE ATT&CK · uses (1)
- G0069 MuddyWater group
References
- https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ CYBERCOM Iranian Intel Cyber January 2022
- https://www.cisa.gov/uscert/ncas/alerts/aa22-055a DHS CISA AA22-055A MuddyWater February 2022