Cisco Talos documented in a report published on Cisco Talos a MuddyWater campaign active through November 2021 targeting Turkish government entities — including the Scientific and Technological Research Council of Turkey (TÜBİTAK) — along with Pakistani and Armenian targets, using malicious PDFs, Excel documents with VBA macros, and Windows executables deploying PowerShell-based downloaders. The campaign introduces canary tokens as a novel anti-analysis mechanism and victim-tracking tool, attributed with high confidence to MuddyWater (also known as MERCURY/Static Kitten), an Iranian MOIS-linked APT active since at least 2017.
Delivery: PDF Lures with Embedded Links to Maldocs or Executables
Initial delivery uses PDF files sharing the author metadata "nejla," presenting fake error messages that prompt victims to click a download link. Links resolve to either malicious XLS Excel files or Windows executables hosted on snapfile[.]org. XLS files are named to impersonate Turkish Health and Interior Ministry documents, with the metadata evolving from early samples containing plaintext author field "Sayyid" / "Aurelia" and unobfuscated PowerShell in document comments to fully obfuscated versions using VBA macros. Executables (e.g., Surec_No_cc2021-...exe, translating to "Period_No_...") similarly use Turkish-language names and display a decoy document (hex-encoded in the binary, hexlified to %TEMP%) before executing the malicious payload.
Infection Chain: VBA Macro to VBS to PS1 Downloader with HKCU Run Persistence
The VBA macro drops three components: a registry Run key at HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random>, an intermediate VBScript executed via the LoLBin pcwutl.dll, and a PowerShell downloader script (PS1). In the EXE-based variant, the instrumentor script .CloudCache.conf and downloader .CloudDrive.conf are written to a hidden user directory, with persistence via SyncAppvPublishingServer.vbs executing obfuscated PowerShell. The PS1 downloader attempts payload download twice with a 40-second timeout, appending the username to the User-Agent with a "|" separator — enabling server-side victim identification. The Pakistani variant added C2-side computer name verification before issuing commands, with AES-encrypted responses returned via http://<C2>/images?guid=<base64+AES_output> using the Googlebot/2.1 User-Agent.
Canary Tokens: Triple-Purpose Anti-Analysis, Infection Tracking, and C2 Monitoring
The most novel element in this campaign is the embedding of canary tokens from canarytokens.com in VBA macros — silently triggered twice during execution. The tokens serve at least three operational purposes: tracking successful victim infections; anti-analysis timing checks (a sandbox that rapidly sequences token requests and payload download requests would have a detectably short interval, enabling server-side payload blocking); and infrastructure monitoring (if tokens fire but no payload server requests follow, the payload C2 has likely been blocked). An earlier equivalent used a custom token-tracking server at hxxp://172.245.81[.]135:10196/Geq5P3aFpaSrK3PZtErNgUsVCfqQ9kZ9/Pan-op/gallery.jpg for Pakistan campaigns, migrated to CanaryTokens for Turkey operations in September 2021.
Attribution: C2 Overlap with Turkish USOM Advisory and Gmail Sender Accounts
Attribution rests on C2 IP overlap with a September 2021 Trakya University / USOM (Turkey National Cyber Incident Response Center) advisory listing 185[.]118[.]167[.]120, 185[.]118[.]164[.]165, 185[.]118[.]164[.]195, and 185[.]118[.]164[.]213, the confirmed use of attacker email doctor.x.2020@gmail[.]com (listed in the advisory) in the Turkey XLS/EXE campaign, code and metadata similarity to prior Secureworks-documented MuddyWater artifacts, and a high-fidelity YARA rule (APT_MuddyWater_MalDoc_Feb20_1 by Florian Roth) matching across campaigns.