April 2023 update – Microsoft Threat Intelligence has shifted to a new threat actor naming taxonomy aligned around the theme of weather. MERCURY is now tracked as Mango Sandstorm.
To learn about how the new taxonomy represents the origin, unique traits, and impact of threat actors, and to get a complete mapping of threat actor names, read this blog: Microsoft shifts to a new threat actor naming taxonomy.
In recent weeks, the Microsoft Threat Intelligence Center (MSTIC) and Microsoft 365 Defender Research Team detected Iran-based threat actor MERCURY leveraging exploitation of Log4j 2 vulnerabilities in SysAid applications against organizations all located in Israel. MSTIC assesses with high confidence that MERCURY’s observed activity was affiliated with Iran’s Ministry of Intelligence and Security (MOIS).
While MERCURY has used Log4j 2 exploits in the past, such as on vulnerable VMware apps, we have not seen this actor using SysAid apps as a vector for initial access until now. After gaining access, MERCURY establishes persistence, dumps credentials, and moves laterally within the targeted organization using both custom and well-known hacking tools, as well as built-in operating system tools for its hands-on-keyboard attack.
This blog details Microsoft’s analysis of observed MERCURY activity and related tools used in targeted attacks. This information is shared with our customers and industry partners to improve detection of these attacks, such as implementing detections against MERCURY’s tools in both Microsoft Defender Antivirus and Microsoft Defender for Endpoint. As with any observed nation-state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information needed to secure their accounts.
Microsoft assesses with moderate confidence that MERCURY exploited remote code execution vulnerabilities in Apache Log4j 2 (also referred to as “Log4Shell”) in vulnerable SysAid Server instances the targets were running. MERCURY has used Log4j 2 exploits in past campaigns as well.
MSTIC assesses with high confidence that MERCURY is coordinating its operations in affiliation with Iran’s Ministry of Intelligence and Security (MOIS). According to the US Cyber Command, MuddyWater, a group we track as MERCURY, “is a subordinate element within the Iranian Ministry of Intelligence and Security.”
The following are common MERCURY techniques and tooling:
This latest activity sheds light on behavior MERCURY isn’t widely known for: scanning and exploiting a vulnerable application on a target’s device. They have been observed performing this activity in the past, but it is not very common. The exploits are derived from open source and sculpted to fit their needs.
On July 23 and 25, 2022, MERCURY was observed using exploits against vulnerable SysAid Server instances as its initial access vector. Based on observations from past campaigns and vulnerabilities found in target environments, Microsoft assess that the exploits used were most likely related to Log4j 2. The threat actor leveraged Log4j 2 exploits against VMware applications earlier in 2022 and likely looked for similarly vulnerable internet-facing apps. SysAid, which provides IT management tools, might have presented as an attractive target for its presence in the targeted country.
Exploiting SysAid successfully enables the threat actor to drop and leverage web shells to execute several commands, as listed below. Most commands are related to reconnaissance, with one encoded PowerShell that downloads the actor’s tool for lateral movement and persistence.
Executed commands:
Once MERCURY has obtained access to the target organization, the threat actor establishes persistence using several methods, including:
The actor leverages the new local administrator user to connect through remote desktop protocol (RDP). During this session, the threat actor dumps credentials by leveraging the open-source application Mimikatz. We also observed MERCURY later performing additional credential dumping in SQL servers to steal other high privileged accounts, like service accounts.
We observed MERCURY further using its foothold to compromise other devices within the target organizations by leveraging several methods, such as:
Most of the commands launched are meant to install tools on targets or perform reconnaissance to find domain administrator accounts.
Throughout the attack, the threat actor used different methods to communicate with their command-and-control (C2) server, including:
Microsoft will continue to monitor MERCURY activity and implement protections for our customers. The current detections, advanced detections, and IOCs in place across our security products are detailed below.
The techniques used by the actor and described in the Observed actor activity section can be mitigated by adopting the security considerations provided below:
The below list provides IOCs observed during our investigation. We encourage our customers to investigate these indicators in their environments and implement detections and protections to identify past related activity and prevent future attacks against their systems.
| Indicator | Type | Description |
| hxxp://sygateway[.]com | Domain | First seen: May 16, 2022 |
| 91[.]121[.]240[.]104 | IP address | First seen: May 17, 2022 |
| 164[.]132[.]237[.]64 | IP address | First seen: November 26, 2021 |
| e81a8f8ad804c4d83869d7806a303ff04f31cce376c5df8aada2e9db2c1eeb98 | SHA-256 | mimikatz.exe |
| 416e937fb467b7092b9f038c1f1ea5ca831dd19ed478cca444a656b5d9440bb4 | SHA-256 | vpnui.exe Ligolo |
| 25325dc4b8dcf3711e628d08854e97c49cfb904c08f6129ed1d432c6bfff576b | SHA-256 | VBScript |
| 3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71 | SHA-256 | Remcom |
| 3137413d086b188cd25ad5c6906fbb396554f36b41d5cff5a2176c28dd29fb0a | SHA-256 | Web shell |
| 87f317bbba0f50d033543e6ebab31665a74c206780798cef277781dfdd4c3f2f | SHA-256 | Web shell |
| e4ca146095414dbe44d9ba2d702fd30d27214af5a0378351109d5f91bb69cdb6 | SHA-256 | Web shell |
| d2e2a0033157ff02d3668ef5cc56cb68c5540b97a359818c67bd3e37691b38c6 | SHA-256 | Web shell |
| 3ca1778cd4c215f0f3bcfdd91186da116495f2d9c30ec22078eb4061ae4b5b1b | SHA-256 | Web shell |
| bbfee9ef90814bf41e499d9608647a29d7451183e7fe25f472c56db9133f7e40 | SHA-256 | Web shell |
| b8206d45050df5f886afefa25f384bd517d5869ca37e08eba3500cda03bddfef | SHA-256 | Web shell |
NOTE: These indicators should not be considered exhaustive for this observed activity.
Community members and customers can find summary information and all IOCs from this blog post in the linked Microsoft Defender Threat Intelligence portal article.
Microsoft Defender Antivirus detects attempted exploitation and post-exploitation activity and payloads. Turn on cloud-delivered protection to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block most new and unknown threats. Refer to the list of detection names related to exploitation of Log4j 2 vulnerabilities. Detections for the IOCs listed above are listed below:
Microsoft Defender for Endpoint customers should monitor the alert “Mercury Actor activity detected” for possible presence of the indicators of compromise listed above.
Reducing the attack surface
Microsoft Defender for Endpoint customers can turn on the following attack surface reduction rule to block or audit some observed activity associated with this threat:
Detecting Log4j 2 exploitation
Alerts that indicate threat activity related to the exploitation of the Log4j 2 exploitation should be immediately investigated and remediated. Refer to the list of Microsoft Defender for Endpoint alerts that can indicate exploitation and exploitation attempts.
Detecting post-exploitation activity
Alerts with the following titles may indicate post-exploitation threat activity related to MERCURY activity described in this blog and should be immediately investigated and remediated. These alerts are supported on both Windows and Linux platforms:
Any alert title related to web shell threats, for example:
Any alert title that mentions PowerShell, for example:
Any alert title related to suspicious remote activity, for example:
Any alert related to persistence, for example:
Any alert title that mentions credential dumping activity or tools, for example:
Microsoft 365 Defender customers can use threat and vulnerability management to identify and remediate devices that are vulnerable to Log4j 2 exploitation. A more comprehensive guidance on this capability can be found on this blog: Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability.
Microsoft Sentinel customers can use the following queries to look for the related malicious activity in their environments.
Identify MERCURY IOCs
The query below identifies matches based on IOCs shared in this post for the MERCURY actor across a range of common Microsoft Sentinel data sets:
Identify SysAid Server web shell creation
The query below looks for potential web shell creation by SysAid Server:
Identify MERCURY PowerShell commands
The query below identifies instances of PowerShell commands used by the threat actor in command line data:
In addition to the above, Microsoft Sentinel users should also look for possible Log4j 2 vulnerabilities, the details of which were shared in a previous blog post.
To locate related activity, Microsoft 365 Defender customers can run the following advanced hunting queries:
Potential WebShell creation by SysAisServer instance
DeviceFileEvents
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe")
| where InitiatingProcessCommandLine has "SysAidServer"
| where FileName endswith ".jsp"
Abnormal process out of SysAidServer instance
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe")
| where InitiatingProcessCommandLine has "SysAidServer"
| summarize makeset(ProcessCommandLine), min(Timestamp), max(Timestamp) by DeviceId
PowerShell commands used by MERCURY
DeviceProcessEvents | where FileName =~ "powershell.exe" and ProcessCommandLine has_cs "-exec bypass -w 1 -enc" | where ProcessCommandLine contains_cs "UwB0AGEAcgB0AC0ASgBvAGIAIAAtAFMAYwByAGkAcAB0AEIAbABvAGMAawAgAHsAKABzAGEAcABzACAAKAAiAHAA" | summarize makeset(ProcessCommandLine), makeset(InitiatingProcessCommandLine, 10), makeset(DeviceId), min(Timestamp), max(Timestamp) by DeviceId
Vulnerable Log4j 2 devices
Use this query to identify vulnerabilities in installed software on devices, surface file-level findings from the disk, and provide the ability to correlate them with additional context in advanced hunting.
DeviceTvmSoftwareVulnerabilities
| where CveId in ("CVE-2021-44228", "CVE-2021-45046")
DeviceTvmSoftwareEvidenceBeta
| mv-expand DiskPaths
| where DiskPaths contains "log4j"
| project DeviceId, SoftwareName, SoftwareVendor, SoftwareVersion, DiskPaths
Since January 2024, Microsoft has observed Secret Blizzard using the tools or infrastructure of other threat groups to attack targets in Ukraine and download its custom backdoors Tavdig and KazuarV2.
Since mid-April 2024, Microsoft has observed an increase in defense evasion tactics used in campaigns abusing file hosting services like SharePoint, OneDrive, and Dropbox. These campaigns use sophisticated techniques to perform social engineering, evade detection, and compromise identities, and include business email compromise (BEC) attacks.
Microsoft has observed the threat actor tracked as Storm-0501 launching a multi-staged attack where they compromised hybrid cloud environments and performed lateral movement from on-premises to cloud environment, leading to data exfiltration, credential theft, tampering, persistent backdoor access, and ransomware deployment. The said attack targeted multiple sectors in the United States, including government, manufacturing, transportation, […]
Between April and July 2024, Microsoft observed Iranian state-sponsored threat actor Peach Sandstorm deploying a new custom multi-stage backdoor, which we named Tickler. Tickler has been used in attacks against targets in the satellite, communications equipment, oil and gas, as well as federal and state government sectors in the United States and the United Arab […]