Check Point Details MOIS-Linked Actors’ Use of Cybercrime Tools
Summary
Check Point researchers describe MOIS-linked actors’ use of criminal tooling, including Rhadamanthys, Tsundere/DinDoor and CastleLoader, and examine infrastructure and certificate overlaps while cautioning that these do not establish a shared operator.
Key points
- Researchers say Void Manticore (Handala) used the commercial infostealer Rhadamanthys alongside custom wipers in phishing lures targeting Israeli organizations.
- MuddyWater activity was linked to the Tsundere botnet; researchers call its Deno-based variant DinDoor.
- The article cites two sources linking Tsundere to MuddyWater and an overlap involving rclone access to Wasabi infrastructure associated with MuddyWater.
- FakeSet, described as a downloader delivering CastleLoader, and malware associated with MuddyWater and DinDoor shared certificates bearing the names “Amy Cherne” and “Donald Gay.” Researchers caution that this may reflect a shared certificate source and does not establish that MuddyWater is a CastleLoader affiliate.
- A Qilin-branded incident at Israel’s Shamir Medical Center was initially described as ransomware. Israeli assessments later pointed toward Iranian actors; officials said operations and patient care were not significantly disrupted, though some information reportedly leaked.
- The researchers argue that criminal tools, services and affiliate models can expand operational capabilities while complicating attribution.
Article Details
- Attack Vectors
- Handala phishing lures impersonated the Israeli National Cyber Directorate and F5 updates to deliver Rhadamanthys and custom wipers to Israeli targets.
- Tsundere/DinDoor used Node.js and JavaScript scripts to execute code on compromised machines, switching to Deno when Node.js was detected.
- FakeSet was identified as a downloader delivering CastleLoader in infection chains.
- MuddyWater-associated activity used rclone to access a Wasabi server; the article links this activity to an IP address previously associated with MuddyWater.
- Iranian-affiliated operators were assessed as likely to have used Qilin ransomware branding and affiliate mechanisms in the Shamir Medical Center intrusion, where attackers claimed data theft and demanded a ransom.
- Defensive Notes
- Use caution when attributing activity based on shared tools, infrastructure, or code-signing certificates; the article warns these overlaps can produce misattribution and combine unrelated activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 18[.]223[.]24[.]218 | IP address linked in the article to MuddyWater-associated infrastructure and rclone access to a Wasabi server. |
| SHA256 | 077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | 24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14 | Malware sample identified in the article's table as StageComp. |
| SHA256 | 2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5 | Malware sample identified in the article's table as DinDoor/Tsundere Deno. |
| SHA256 | 2b7d8a519f44d3105e9fde2770c75efb933994c658855dca7d48c8b4897f81e6 | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | 4aef998e3b3f6ca21c78ed71732c9d2bdcc8a4e0284f51d7462c79d446fbc7be | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | 64263640a6fdeb2388bca2e9094a17065308cf8dcb0032454c0a71d9b78327eb | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | 64cf334716f15da1db7981fad6c81a640d94aa1d65391ef879f4b7b6edf6e7f1 | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | 74db1f653da6de134bdc526412a517a30b6856de9c3e5d0c742cb5fe9959ad0d | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | 94f05495eb1b2ebe592481e01d3900615040aa02bd1807b705a50e45d7c53444 | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | a4bd1371fe644d7e6898045cc8e7b5e1562bdfd0e4871d46034e29a22dec6377 | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | a8c380b57cb7c381ca6ba845bd7af7333f52ee4dc4e935e98b48bb81facad72b | Malware sample identified in the article's table as FakeSet/CastleLoader. |
| SHA256 | a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0 | Malware sample identified in the article's table as StageComp. |
| SHA256 | aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1f | Malware sample listed among Handala Rhadamanthys variants. |
| SHA256 | ddceade244c636435f2444cd4c4d3dc161981f3af1f622c03442747ecef50888 | Malware sample identified in the article's table as FakeSet/CastleLoader. |
MITRE ATT&CK
T1059.007 · JavaScriptTsundere/DinDoor used JavaScript scripts, with execution through Node.js or Deno on compromised machines.T1105 · Ingress Tool TransferFakeSet acted as a downloader delivering CastleLoader in infection chains.T1485 · Data DestructionVoid Manticore/Handala used custom wipers in disruptive operations.T1553.002 · Code SigningCertificates under the Common Names “Amy Cherne” and “Donald Gay” were used to sign FakeSet/CastleLoader, StageComp, and DinDoor samples.T1566 · PhishingHandala used phishing lures impersonating the Israeli National Cyber Directorate and F5 updates to deliver Rhadamanthys and custom wipers.T1588.001 · MalwareThe article describes CastleLoader as a Malware-as-a-Service offering used by multiple affiliates and discusses Iranian-affiliated operators leveraging criminal affiliate ecosystems.
Threat Actors
HandalaThe article explicitly identifies Handala Hack as another name for Void Manticore; its Handala persona used phishing lures to deliver Rhadamanthys and custom wipers.HezbollahThe article assesses that the targeting of Israeli hospitals may form part of a broader sustained campaign by MOIS and Hezbollah; it does not establish Hezbollah's role in the specific Shamir Medical Center intrusion.Ministry of Intelligence and Security (MOIS)The article associates cyber operations by Iranian-linked actors with MOIS objectives and describes MuddyWater as a subordinate element within MOIS, citing CISA.MuddyWaterU.S. authorities link MuddyWater to Iran's MOIS; the article associates it with cyber espionage and other operations, and says it likely used the Tsundere botnet based on reported infrastructure and telemetry links.QilinThe Shamir Medical Center incident was initially described as linked to Qilin, but later Israeli assessments pointed to Iranian actors as the likely operators using the ransomware brand and affiliate ecosystem.Void ManticoreThe article identifies Void Manticore as an Iranian threat actor conducting strategic cyber operations, including hack-and-leak and disruptive operations, and says it used the Handala and Homeland Justice personas.
Malware
CastleLoaderCastleLoader (via FakeSet downloader) and other Malware-as-a-Service offerings appear in infection chains, suggesting use of affiliate-style ecosystems rather than exclusive in-house tooling.DinDoorThis trend includes use of infostealers (Rhadamanthys), botnets (Tsundere/DinDoor), code-signing certificates shared across families, and ransomware branding (Qilin) in incidents such as the Shamir Medical CenterFakesetCastleLoader (via FakeSet downloader) and other Malware-as-a-Service offerings appear in infection chains, suggesting use of affiliate-style ecosystems rather than exclusive in-house tooling.RhadamanthysThis trend includes use of infostealers (Rhadamanthys), botnets (Tsundere/DinDoor), code-signing certificates shared across families, and ransomware branding (Qilin) in incidents such as the Shamir Medical CenterStagecompShared code-signing certificates (Common Names “Amy Cherne” and “Donald Gay”) linked multiple malware families (FakeSet/CastleLoader, StageComp, DinDoor/Tsundere), indicating common certificate sources or resale.Tsundere BotnetThis trend includes use of infostealers (Rhadamanthys), botnets (Tsundere/DinDoor), code-signing certificates shared across families, and ransomware branding (Qilin) in incidents such as the Shamir Medical Center
Products
Deno[T1059 ] Command and Scripting Interpreter – JavaScript runtimes (Node.js and Deno) used to execute code on compromised hosts; quote: ‘…when the Node.js engine is detected, the botnet shifts to an alternative executionNode.js[T1059 ] Command and Scripting Interpreter – JavaScript runtimes (Node.js and Deno) used to execute code on compromised hosts; quote: ‘…when the Node.js engine is detected, the botnet shifts to an alternative execution
Tools
Countries
AlbaniaIt has leveraged “hacktivistic” personas such as Homeland Justice in attacks against Albania and Handala in operations targeting Israel.IranIran-linked actors—particularly MOIS-associated groups such as Void Manticore and MuddyWater—are increasingly using criminal tools, malware-as-a-service, and cybercrime infrastructure to further state objectives whileIsraellater linked that concern to attacks aimed at Israeli and Jewish targets, including incidents near Israel’s embassy in Stockholm.
Industries
Defensetargeting government and private-sector organizations across sectors including telecommunications, defense, and energy.Energygovernment and private-sector organizations across sectors including telecommunications, defense, and energy.GovernmentMOIS and has carried out broad campaigns in support of Iranian intelligence objectives, targeting government and private-sector organizations across sectors including telecommunications, defense, and energy.Telecommunicationsobjectives, targeting government and private-sector organizations across sectors including telecommunications, defense, and energy.