Threat Source newsletter (March 17, 2022) — Channelling productive worry to help Ukraine
Summary: Cisco Talos reports that MuddyWater, which U.S. Cyber Command has publicly linked to Iranian state interests, appears to be a collection of smaller independently operating sub-groups rather than one large group, and is running a new maldoc campaign against Turkey and the Arabian Peninsula that delivers a Windows script file-based RAT called SloughRAT. The newsletter also notes that Cyclops Blink malware, first spotted targeting MikroTik routers, is now targeting Asus routers, and that the Dirty Pipe Linux kernel vulnerability affecting version 5.8 and later allows attackers to obtain root privileges and affects QNAP NAS appliances and Android devices.
Why it matters: MuddyWater's structure as multiple sub-groups developing new TTPs with each campaign means defenses tuned to a single actor's known behavior will lag, and Dirty Pipe's root-level impact on kernel 5.8 and later puts QNAP NAS appliances and Android devices in scope.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026