Cyber ​​attack on 100 government entities in the Middle East | technology

The hacker group known as “MuddyWater” was able to launch a group of cyber attacks on more than 100 government entities in various countries using the latest version of the “Phoenix” vulnerability, according to a report published by the technical website “Bleeping Computer”.

The report indicates that the group is linked to the Iranian government, as well as its spread under more than one other name, such as “Static Kitten,” “Mercury,” and “SeedWorm,” and it usually targets governments and private organizations in the Middle East.

This attack began last August using a phishing campaign from a hacked account, and the group then sent a group of fraudulent emails to several international and governmental organizations in the Middle East and North Africa.

Researchers at the security company Group-IB were able to discover and study this attack, confirming that the attack caused the servers in several government services to stop.

The security company’s report confirmed that the victims of this attack were mostly embassies, diplomatic missions, foreign ministries, and various consulates.

In the attack, the group used Word documents that contained corrupted macro codes that caused the hack, which is one of the attack techniques that was very common in the past until Microsoft stopped it.

The attack depends on collecting information from the victim’s device, such as its domain address, computer name, and user data registered with it.

The report also indicated that the group used another data theft tool designed to work with browsers and steal data contained in them, including Chrome, Opera, Brave, and Edge browsers.