ChainShell: MuddyWater & Russian MaaS

Summary

MuddyWater, an Iran-linked espionage actor, is leveraging the Russian TAG-150 malware-as-a-service platform to deliver CastleRAT and a newer Node.js, blockchain-enabled C2 agent tracked as ChainShell against Israeli and other high-value targets. The activity is supported by an exposed, misconfigured C2 web server, a PowerShell deployer script (reset.ps1), and PE payloads concealed via steganography. Multiple CastleRAT releases (including Build 120 and Build 13) contain shared hard-coded identifiers that point to the same MaaS lineage. The backend infrastructure appears to be campaignized, using shared domains (for example, serialmenot.com) and per-operation JWT credentials to separate access and tracking across deployments.

Investigation

JUMPSEC reviewed the exposed C2 host, recovered 15 malware samples, and tied the reset.ps1 deployment logic to delivery of both ChainShell and multiple CastleRAT builds. Investigators also correlated code-signing certificates (Amy Cherne and Donald Gay) seen in known MuddyWater tooling to the TAG-150 MSI installer, forming a high-confidence attribution trail. Additional overlap was observed across samples in hard-coded build markers, recurring scheduled-task naming conventions, and JWT campaign IDs embedded in the tooling and server-side artifacts.

Mitigation

Monitor for reset.ps1, associated scheduled tasks, and unique mutex or file-path artifacts linked to CastleRAT and ChainShell. Block known TAG-150 infrastructure, including serialmenot.com, ttrdomennew.com, and sharecodepro.com, and scrutinize PowerShell-driven installation of Node.js components. Enforce strict code-signing controls and validate suspicious certificates against known MuddyWater-linked signing material.

Response

If indicators are found, isolate impacted endpoints, capture full disk and memory images, and sweep for additional CastleRAT and ChainShell remnants. Revoke or distrust compromised code-signing certificates, reset affected credentials, and coordinate reporting with relevant national CERTs. Review network telemetry for Ethereum RPC access patterns and JWT usage tied to the serialmenot.com command-and-control workflow.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:

  1. Stage 1 – Prepare a simple C2 server (run on the attacker machine or a controlled VM). The server listens on port 9999 and echoes received data.

  2. Stage 2 – On the target Windows host, launch a PowerShell back‑door that opens a TCP connection to the C2 server on port 9999. The payload uses native .NET classes to avoid creating a separate executable, mimicking a “living‑off‑the‑land” approach.

  3. Stage 3 – Optional proxy hop: The PowerShell script first contacts a local HTTP proxy (listening on 127.0.0.1:8080) which forwards the TCP traffic to the remote C2 server, demonstrating that the destination port stays unchanged.

  These steps produce firewall events with DestinationPort = 9999, satisfying the Sigma rule.

• Regression Test Script:

  # -------------------------------------------------
  # CastleRAT‑style C2 simulation – PowerShell
  # -------------------------------------------------
  # 1. Define C2 server address (replace with your test IP)
  $c2Ip = "10.0.0.50"
  $c2Port = 9999
  
  # 2. OPTIONAL: Define local proxy (if you want to test proxy hop)
  $useProxy = $false
  $proxyHost = "127.0.0.1"
  $proxyPort = 8080
  
  # 3. Function to open a TCP stream (direct or via proxy)
  function Invoke-C2Connection {
      param (
          [string]$destIp,
          [int]$destPort,
          [bool]$viaProxy
      )
      if ($viaProxy) {
          # Simple HTTP CONNECT tunnel
          $proxyUri = "http://$proxyHost`:$proxyPort"
          $client = New-Object System.Net.Sockets.TcpClient($proxyHost,$proxyPort)
          $stream = $client.GetStream()
          $connectRequest = "CONNECT $destIp`:$destPort HTTP/1.1`r`nHost: $destIp`r`n`r`n"
          $bytes = [System.Text.Encoding]::ASCII.GetBytes($connectRequest)
          $stream.Write($bytes,0,$bytes.Length)
          # Discard proxy response
          $buffer = New-Object byte[] 1024
          $null = $stream.Read($buffer,0,$buffer.Length)
          Write-Host "[+] Proxy tunnel established"
          return $stream
      } else {
          $client = New-Object System.Net.Sockets.TcpClient($destIp,$destPort)
          Write-Host "[+] Direct TCP connection established"
          return $client.GetStream()
      }
  }
  
  # 4. Open the connection
  $stream = Invoke-C2Connection -destIp $c2Ip -destPort $c2Port -viaProxy:$useProxy
  
  # 5. Send a simple beacon
  $beacon = "CastleRAT Beacon $(Get-Date -Format o)`n"
  $bytes = [System.Text.Encoding]::UTF8.GetBytes($beacon)
  $stream.Write($bytes,0,$bytes.Length)
  Write-Host "[+] Beacon sent"
  
  # 6. Keep the channel open for a short period (simulate persistence)
  Start-Sleep -Seconds 15
  
  # 7. Cleanup
  $stream.Close()
  Write-Host "[+] Connection closed"

• Cleanup Commands:

  # Ensure any lingering TCP connections are closed
  Get-NetTCPConnection -RemotePort 9999 -State Established | ForEach-Object {
      try {
          $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
          if ($proc) { Stop-Process -Id $proc.Id -Force }
      } catch {}
  }
  
  # Remove any temporary proxy listener if it was started locally
  Stop-Process -Name "python" -Force -ErrorAction SilentlyContinue

Additional Observations & Hardening Recommendations

1. Enrich Port‑Based Detection: Combine the port check with known malicious C2 IPs/domains, TLS fingerprinting, or abnormal traffic volume heuristics.
2. Allow‑List Legitimate Services: Create an exception list for applications that legitimately use ports 9999 or 8888 (e.g., certain database or management tools).
3. Behavioural Baselines: Deploy statistical models to flag low‑frequency outbound connections to high‑risk ports originating from non‑server endpoints.
4. Process Context: Correlate firewall events with the originating process (ImageFileName, CommandLine). Flag connections made by unexpected processes (e.g., powershell.exe, cmd.exe).

By applying these mitigations, the rule’s resilience can be raised from the current 2 to a 4‑5 range, dramatically reducing false positives while preserving detection of genuine CastleRAT C2 traffic.