STARWHALE

MITRE ATT&CK: S1037 View on attack.mitre.org

Aliases: CANOPY, Canopy, SloughRAT, STARWHALE

First seen
2021-11-01 00:00:00
Malware type
backdoor, rat
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 13:22:52

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:ir country_code:sa

Context

STARWHALE is Windows Script File (WSF) backdoor that has been used by MuddyWater, possibly since at least November 2021; there is also a STARWHALE variant written in Golang with similar capabilities. Security researchers have also noted the use of STARWHALE by UNC3313, which may be associated with MuddyWater.

Detection coverage

  • 268 Sigma rules

Malware & tools used

  • System Information Discovery (attack-pattern)
  • Windows Service (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Web Protocols (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Malicious File (attack-pattern)
  • Visual Basic (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Data from Local System (attack-pattern)
  • Local Data Staging (attack-pattern)

Used by threat actors

Reports & references

  • CISA — Aa22 055A (report)
  • inforisktoday.com — Muddywater Targets Critical Infrastructure In Asia Europe A 18611 (report)
  • thehackernews.com — Irans Muddywater Hacker Group Using New (report)
  • malpedia.caad.fkie.fraunhofer.de — Vbs.Starwhale (report)
  • Cisco Talos — Iranian Supergroup Muddywater (report)
  • Cisco Talos — Iranian Supergroup Muddywater (report)
  • thehackernews.com — Iranian Hackers Targeting Turkey And (report)
  • rootdaemon.com — Iranian Hackers Targeting Turkey And Arabian Peninsula In New Malware Campaign (report)
  • govinfosecurity.com — Iranian Apt New Methods To Target Turkey Arabian Peninsula A 18706 (report)
  • Mandiant — Telegram Malware Iranian Espionage (report)
  • techrepublic.com — Muddywater Targets Middle Eastern And Asian Countries In Phishing Attacks (report)
  • MITRE ATT&CK — S1037 (report)

External references