STAC 1171
STAC 1171 is a Sophos-tracked activity cluster that Sophos assesses with moderate confidence is related to the Iranian threat actor MuddyWater, also known as TA450, based on indicator and TTP overlap with Proofpoint reporting. Sophos observed the cluster in a phishing-led intrusion campaign in which victims were directed via a Onehub-hosted shared document to download a ZIP archive containing a compressed installer for the legitimate remote monitoring and management tool Atera. After Atera Agent was installed, the operators used Atera remote run commands to execute a PowerShell script named a.ps1 intended to dump credentials and create a backup of the SYSTEM registry hive. Observed post-compromise activity included domain enumeration, creation of an SSH tunnel to 51.16.209[.]105, and an obfuscated PowerShell command to download the Level RMM tool from downloads.level.io. The first tracked incident occurred in November against an organization in Israel, and Sophos also observed similar telemetry affecting a non-MDR customer in the United States. Known aliases directly mentioned in the content are MuddyWater and TA450.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇮🇱 Israel
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- IR
Tradecraft
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting targeted phishing campaigns to trick victims into installing legitimate RMM tools such as Atera, then using remote commands and PowerShell to dump credentials, save the SYSTEM registry hive, enumerate domains, establish an SSH tunnel, and download Level RMM.
Conducting targeted phishing campaigns to trick victims into downloading legitimate RMM tools such as Atera, then using remote execution and PowerShell to dump credentials, save the SYSTEM registry hive, enumerate domains, establish an SSH tunnel, and download Level RMM.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.