Quote:The cyber-espionage group known as MuddyWater has used an updated multi-stage PowerShell backdoor in recent campaigns, Trend Micro’s security researchers report.
 
First detailed in 2017, the threat actor has been highly active during the last several months of 2018, when it reportedly hit over 130 victims in 30 organizations. 
 
Over the past couple of years, the threat actor was observed expanding its target list and numerous attacks were linked to it, as well as malware found to resemble the actor’s usual set of backdoors. 
 
Following Kaspersky’s recent analysis of MuddyWater post-infection tools, Trend Micro now says that the cyber-spies have updated their PowerStats backdoor, and that the new variant has already been observed in a spear-phishing campaign targeting a university in Jordan and the Turkish government. 
 
Leveraging compromised legitimate accounts to trick victims into installing malware, the emails contained a document embedded with a malicious macro to drop a VBE file that holds a block of data containing an obfuscated PowerShell script.