RemoteUtilitiesTool
RemoteUtilities is a legitimate remote administration tool that has been used by MuddyWater since at least 2021 for execution on target machines.From MITRE ATT&CK
Last reported 3 years ago, by Group-IB1 report
What the reports say
1 report, newest first · the exact sentence from each-
SimpleHarm: Tracking MuddyWater’s infrastructure“In the last few years, the group has been using legitimate remote control tools such as ScreenConnect, RemoteUtilities, and Syncro.”
Indicators in its reports
named in the reports above- 51.254.25[.]36in 1 report
- 53ce7a2850e27465…1a3ec1b6a640in 1 report
- 51.255.19[.]179in 1 report
- 51.255.19[.]178in 1 report
- 164.132.237[.]64in 1 report
- 91.121.240[.]104in 1 report
- 164.132.237[.]65in 1 report
- e7383c77c6f804cffac6c88651b7bce2in 1 report
- 137.74.131[.]24in 1 report
- 91.121.240[.]96in 1 report
- 2528838a609aa143…6ce64b2a1507in 1 report
- hxxp://91.121.240[.]108:443/HBIyin 1 report
- 91.121.240[.]108in 1 report
- hxxps://mohap.gov[.]ae/in 1 report
- mohap.gov[.]aein 1 report
- hxxps://mohap.gov[.]aein 1 report
- 178.32.30[.]3in 1 report
- 149.202.242[.]80in 1 report
- 164.132.237[.]66in 1 report
- 3648a6085512ab91f5a23bafb8418f7bin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.