MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations

Microsoft Threat Intelligence Center (MSTIC) and Microsoft 365 Defender Research Team detected Iran-based threat actor MERCURY leveraging exploitation of Log4j 2 vulnerabilities in SysAid applications against organizations all located in Israel. MSTIC assesses with high confidence that MERCURY’s observed activity was affiliated with Iran’s Ministry of Intelligence and Security (MOIS).

REFERENCE: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/

TAGS: MERCURY, Iran, Log4j, SysAid

ADVERSARY: MERCURY

MALWARE FAMILY: MERCURY

ATT&CK IDS: T1059 - Command and Scripting Interpreter, T1547 - Boot or Logon Autostart Execution, T1114 - Email Collection

Read More:

https://otx.alienvault.com/pulse/6308c120cac2d8874c250093