Iranian group APT ITG17 AKA MuddyWater using PowerShell back door to hack Slack and abuse C2C privileges

IBM Security X-Force reports that Iranian government actor MuddyWater used a PowerShell back door known as Aclip to use Slack as a means of attacking airlines. It turned out that these cybercriminals were using the free workspaces in Slack to hide malicious traffic and then commit C2C crimes against airline employees.

This activity was first discovered by MuddyWater Hacking Group in October 2019, when a malicious backdoor called Aclip was first developed. Aclip then executes the command and control over the Slack API to receive data and commands.

Diagram of Aclip Backdoor execution 

Aclip first runs through the aclip.bat file and then collect hostname username and external IP from victims in base64 format. Then by running C2C the screenshots are taken in PowerShell and saved in the% TEMP% folder. The C2 server used was 46.166.176 [.] 210.

After the IBM X-force found the breach, Slack removed the free workspaces used by the backdoor but it is clear that MuddyWater will continue its efforts to use C2C for malicious gains. They must be stopped !! 😡😡

Iranian hackers Shia Eagle hack Jerusalem Post and Maariv Online on anniversary of Soleimani's death. ⚰️

On Monday it was revealed that the Israeli newspapers Jerusalem Post and Maariv Online had been hacked and hacked exactly two years since Soleimani's death. Both newspaper websites with defaced with a threatening image claiming revenge for Soleimani's death. This image shows the Dimona nuclear base in Israel being destroyed by a rocket fired from a hand very similar to Soleimani's.

        Image that was displayed on hacked websites after attack

No hacker group inside Iran has officially claimed responsibility for the attack, but a Twitter account called @shiaeagle posted several tweets at the time of the attack that strongly claimed responsibility. Twitter has since blocked the account.

                Shia Eagle twitter account which is now banned 

It is clear that in 2022 this cyber war between Israel and Iran has no sign of stopping.😢 This cyber attack could also be a statement by this corrupt Iranian regime that its nuclear program is being implemented at 100 percent and could be used as another negotiating tactic in the JCPOA Vienna talks. very sad!!!! 😭