{"id":20772,"date":"2022-09-02T06:00:40","date_gmt":"2022-09-02T06:00:40","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=20772"},"modified":"2026-04-17T18:07:43","modified_gmt":"2026-04-17T18:07:43","slug":"investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/","title":{"rendered":"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2]"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Part 1: Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [1]<\/a><\/p>\n\n\n\n

Characteristics of Attack Tactics<\/h2>\n\n\n\n

Use compromised sites:<\/strong><\/p>\n\n\n\n

MurenShark tends to use compromised sites as the file server and the C&C server in the attack process. As shown in the last chapter, the organization used the Near East University site (Yakın Doğu Üniversitesi) (https:\/\/neu.edu.tr\/) as a remote server.<\/p>\n\n\n\n

The Near East University is a private university located in Northern Cyprus. The known attack process shows that MurenShark has controlled the official website server of the university for more than one year, placed Trojan horse programs in multiple locations on the website, run the LetMeOut Trojan horse server program, and even deployed the server of the CobaltStrike penetration platform to continuously control the victims.<\/p>\n\n\n\n

\"Red<\/a>
The Uni site under hacker control<\/figcaption><\/figure>\n\n\n\n

Although it has such attack resources, MurenShark is relatively restrained in the use of the compromised sites. These sites are silent for most of the time and have not been traded or abused. This utilization of the compromised sites by MurenShark effectively hides the traces of organization and extends the available period of resources.<\/p>\n\n\n\n

Breakdown of component behaviors<\/strong><\/p>\n\n\n\n

When designing the process, MurenShark follows a special pattern of behavior splitting.<\/p>\n\n\n\n

For example, the new version of NiceRender attack component recently used by the organization divides the malicious documents’ normal functions into two parts. Part A is designed as a macro code reader and injector, and part B is designed as a macro code carrier and injection carrier. Part A needs to obtain Part B through network connection to carry out the complete component behavior.<\/p>\n\n\n\n

For example, the LetMeOut Trojan program commonly used by the organization will also split its download function into two parts. The Trojan first uploads the Trojan information and the victim host information to the C&C server . After receiving the confirmation information from the server, the Trojan obtains the download path of the subsequent payload through calculation.<\/p>\n\n\n\n

The advantages of this design are obvious. In cooperation with the compromised site described above, when the remote address of these components fails or stops service, there will not be any malicious behavior characteristics on the network side and the process side, and even untrained personnel cannot detect abnormalities when opening the corresponding files. These subdivided component behaviors also interfere with forensics analysis and attack process restoration. A large number of interaction mechanisms effectively protect the network resources and attack components in the process and reduce the exposure probability.<\/p>\n\n\n\n

When the C&C server  is disconnected, the behavior of the new version of NiceRender is similar to that of the normal document:<\/p>\n\n\n\n

\"Red<\/a>
NiceRender behavior under disconnection<\/figcaption><\/figure>\n\n\n\n

Known Attack Tools<\/h2>\n\n\n\n

NiceRender<\/strong><\/p>\n\n\n\n

This tool is a malicious macro type document with a specific execution mode. MurenShark attackers use this tool to create various phishing documents and use them as the preliminary step of attack activities. There are currently two versions of this tool.<\/p>\n\n\n\n

NiceRender Ver.1<\/strong><\/p>\n\n\n\n

The early version of NiceRender includes three functional parts: bait decoding, online notification and payload release.<\/p>\n\n\n\n

(I)Decoy decoding<\/strong><\/p>\n\n\n\n

The biggest difference between NiceRender and other common phishing documents is that the component will use a unique logic to transcode the text content in the document into garbled characters, and decode these garbled characters, giving the victim an illusion that the encrypted document has indeed been decrypted, thus increasing the credibility of such phishing documents.<\/p>\n\n\n\n

NiceRender’s character transcoding logic is to search for specific wide byte characters and convert them into corresponding ASCII characters.<\/p>\n\n\n\n

The decimal value sequence corresponding to the wide character to be converted is:<\/p>\n\n\n\n

[321, 325, 338, 334, 332, 331, 324, 329, 335, 333, 341, 340, 339, 322, 345, 353, 357, 361, 370, 366, 364, 363, 356, 367, 365, 373, 372, 371, 354, 377]<\/p>\n\n\n\n

The corresponding ASCII character sequence is:<\/p>\n\n\n\n

[A, E, R, N, L, K, D, I, O, M, U, T, S, B, Y, a, e, i, r, n, l, k, d, o, m, u, t, s, b, y]<\/p>\n\n\n\n

After the conversion is completed, NiceRender will hide the “enable editing” notification at the top of the original content to further improve the credibility of the document.<\/p>\n\n\n\n

The following figure shows the comparison between the original content of a typical NiceRender bait and the effect after transcoding.<\/p>\n\n\n\n

\"Red<\/a>
Comparison of NiceRender bait before and after decoding<\/figcaption><\/figure>\n\n\n\n

(II) Online notification<\/strong><\/p>\n\n\n\n

This version of NiceRender has a special operation, which will notify the attacker through the network when the macro code is running.<\/p>\n\n\n\n

This notification operation is realized through the DNS resolution mechanism. The NiceRender producer first registers the domain name “cachedns. IO” and binds the resolution server of the domain to itself:<\/p>\n\n\n\n

\"Red<\/a><\/figure>\n\n\n\n

When the macro code of the NiceRender document runs, the current timestamp will be obtained and combined into a domain name in the following format:<\/p>\n\n\n\n

[timestamp]. D0g3.cachedns.io<\/p>\n\n\n\n

The Trojan then performs DNS query on the domain name. Since the attacker has set the primary domain as described above, the DNS related query request will be directly sent to the domain name server deployed by the attacker. The attacker can read the domain name and obtain the tag (d0g3) and running time (timestamp) information of the corresponding NiceRender component to control the running state and attack scale of the component.<\/p>\n\n\n\n

(III) Payload release<\/strong><\/p>\n\n\n\n

NiceRender then reads the text information in the specific object in the document, obtains a PE file and saves it to %LOCALAPPDATA%\\Microsoft\\EdgeFss\\FileSyncShell64.dll. The PE file is the UniversalDonut Trojan.<\/p>\n\n\n\n

It should be noted that NiceRender uses a COM component hijacking policy to load the DLL file. The tool adds a running key to the windows scheduled task MsCtfMonitor by modifying the registry key, which points to the above DLL file path to run malicious programs.<\/p>\n\n\n\n

\"Red<\/a>
Registry key written by NiceRender<\/figcaption><\/figure>\n\n\n\n

The specific implementation of the hijacking logic can be referred to:<\/p>\n\n\n\n

https:\/\/github.com\/S3cur3Th1sSh1t\/OffensiveVBA\/blob\/main\/src\/COMHijack_DLL_Load.vba<\/a><\/p>\n\n\n\n

UniversalDonut<\/strong><\/p>\n\n\n\n

MurenShark attackers frequently use a Trojan program in the form of DLL as a transitional component in their attack process. NSFOCUS Security Labs named it UniversalDonut according to the key information of this component.<\/p>\n\n\n\n

UniversalDonut is a Trojan program of shellcode loader type. After the Trojan is executed, first detect the following items:<\/p>\n\n\n\n

  1. Check whether the parent process name is C: \\ windows \\ system32 \\ taskhost.exe;<\/li>
  2. Detect whether it is a high privilege process<\/li><\/ol>\n\n\n\n

    After the detection passes, the Trojan uses the multibyte XOR algorithm to decrypt a section of shellcode contained in the resource section and run it.<\/p>\n\n\n\n

    The shellcode carried by UniversalDonut is a complete payload generated by an open source framework Donut (https:\/\/github.com\/TheWover\/donut). With this framework, UniversalDonut can implement a large number of countermeasures in the shellcode execution stage, including Chaskey algorithm encryption, AMSI \/ WDLP bypass, connectivity detection, etc. Most importantly, the. Net support provided by Donut allows MurenShark attackers to use this shellcode to load LetMeOut, the main Trojan horse in subsequent stages.<\/p>\n\n\n\n

    LetMeOut<\/strong><\/p>\n\n\n\n

    LetMeOut is a kind of .Net downloader Trojan, equipped with a unique insurance mechanism. MurenShark has used this Trojan horse many times in the invasion process.<\/p>\n\n\n\n

    The main code logic of LetMeOut is divided into two parts:<\/p>\n\n\n\n

    The program first confirms whether there is a binary file named FileSyncShell64.dat under the directory %LOCALAPPDATA%\\Microsoft\\EdgeFss\\. If the file is found, decrypts and decompresses the file using the multibyte XOR algorithm and gzip compression algorithm, and then loads it into memory for operation.<\/p>\n\n\n\n

    Judging by the behavior, the FileSyncShell64.dat is an encrypted Trojan file cached locally by the Trojan program after C&C communication.<\/p>\n\n\n\n

    If a file named FileSyncShell64.dat is not found in the specified directory, the Trojan will specify the C&C server address for HTTP communication, and attach three pieces of information in the HTTP parameter section.<\/p>\n\n\n\n

    P1    base64 transcoding, Current proxy content<\/p>\n\n\n\n

    P2    base64 transcoding, http User-Agent content<\/p>\n\n\n\n

    P3    Boolean value, TRUE or FALSE on 64-bit process<\/p>\n\n\n\n

    Thenthe program makes a second HTTP request to obtain the contents of a hash path obtained through calculation. The hash path is calculated by the following parameters:<\/p>\n\n\n\n

    \"Red<\/a>
    The parameter that LetMeOut used for computing hash pathway<\/figcaption><\/figure>\n\n\n\n

    The decryption method of the encrypted content contained in the reply package is the same as that of the FileSyncShell64.dat file. The LetMeOut Trojan will run the decrypted content in the form of shellcode.<\/p>\n\n\n\n

    CobaltStrike<\/strong><\/p>\n\n\n\n

    MurenShark uses the famous CobaltStrike penetration platform to manage the invaded hosts, and completes horizontal movement and secret theft through the CobaltStrike Beacon Trojan horse program.<\/p>\n\n\n\n

    Related Investigation<\/h2>\n\n\n\n

    Attack on Scientific and Technological Research Council of Turkey<\/p>\n\n\n\n

    According to the investigation conducted by NSFOCUS Security Labs, one of the main targets of MurenShark, Scientific and Technological Research Council of Turkey, is not the first time to be attacked. As a top scientific research institution that has undertaken a large number of national projects in Turkey, it is a key victim of various hacking activities and even APT activities.<\/p>\n\n\n\n

    A type of frequent attacks against this institution are launched in the form of phishing emails. The attackers use common payloads such as compressed package attachments and vulnerability documents to deliver AgentTesla and other secret theft Trojans to the users of tubitak.gov.tr mailbox, and collect files, credentials and browser cache data on the victim’s host.<\/p>\n\n\n\n

    \"Red<\/a>
    Phishing email for Scientific and Technological Research Council of Turkey (a)<\/figcaption><\/figure>\n\n\n\n

    There are also some e-mails with forged quotation request and organization pictures of Scientific and Technological Research Council of Turkey in the mail body, and the attachments of the e-mails carry AgentTesla Trojan horse in the form of compressed package.<\/p>\n\n\n\n

    \"Red<\/a>
    Phishing email for Scientific and Technological Research Council of Turkey (b)<\/figcaption><\/figure>\n\n\n\n

    The above-mentioned attacks are very typical in the phishing mail activities in recent years. The mail hacker organization will use this method to steal various documents in the victim’s host and sell them in black market. These phishing emails indicate that Scientific and Technological Research Council of Turkey has been exposed in a high risk of data leakage for a long time. Another type of attack is more serious, directly from MuddyWater, an Iranian APT organization. MuddyWater launched a series of phishing attacks against Scientific and Technological Research Council of Turkey around 2019. The process of such attacks is relatively simple, that is to use several types of PowerShell Trojans by delivering bait documents with keyword “TÃœBÄ°TAKâ€.<\/p>\n\n\n\n

    \"Red<\/a>
    Phishing document a for Scientific and Technological Research Council of Turkey(a)<\/figcaption><\/figure>\n\n\n\n
    \"Red<\/a>
    Phishing document a for Scientific and Technological Research Council of Turkey(b)<\/figcaption><\/figure>\n\n\n\n

    After finding this clue, NSFOCUS Security Labs launched an investigation into the possible relationship between MurenShark and MuddyWater.<\/p>\n\n\n\n

    NSFOCUS Security Labs has reproduced the known activities and wild samples of muddwater for Turkey science and Technology Research Institute, and compared them with MurenShark activities in the following dimensions:<\/p>\n\n\n\n

    Comparison of related activities<\/p>\n\n\n\n

     <\/td>MurenShark<\/strong><\/td>MuddyWater<\/strong><\/td><\/tr>
    Direct target<\/strong><\/td>Scientific and Technological Research Council of Turkey or Turkey military<\/td>Scientific and Technological Research Council of Turkey<\/td><\/tr>
    Initial payload<\/strong><\/td>Phishing documents<\/td>Phishing documents<\/td><\/tr>
    Bait type<\/strong><\/td>Recoverable document<\/td>unrecoverable document<\/td><\/tr>
    Attack tools<\/strong><\/td>UniversalDonut, LetMeOut<\/td>POWERSTATS or other PowerShell Trojan<\/td><\/tr>
    Network resource<\/strong><\/td>Compromised site<\/td>VPS server<\/td><\/tr>
    Final payload<\/strong><\/td>CobaltStrike Beacon Trojan<\/td>PowerShell back door<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Through comparison, it can be seen that the differences in characteristics between MurenShark and MuddyWater are greater than the commonalities. The two show similarities in attack target selection and initial stage components, but there is no overlap in subsequent execution processes.<\/p>\n\n\n\n

    In general, since the attack activities of MuddyWater are relatively intensive, MuddyWater attackers appear to be impatient in component design and resource use. In its activities against Scientific and Technological Research Council of Turkey, the organization copied the known attack methods, and the component design was relatively rough. In the process of disk recovery, NSFOCUS Security Labs observed design defects such as irreducible bait content and reusing the exposed C&C server address. On the contrary, MurenShark developers are more careful in the design of components and processes, focusing on hiding behavior traces and personal information to reduce exposure risks.<\/p>\n\n\n\n

    MuddyWater is an old-fashioned APT organization whose actions represent Iran’s national interests. The intersection of MurenShark and MuddyWater in terms of attack targets provides a few clues for the subsequent determination of organization affiliation.<\/p>\n\n\n\n

    Summary<\/h2>\n\n\n\n

    MurenShark is a new APT organization targeting at Turkey. Through investigation and analysis, NSFOCUS Security Labs explored the main activities and technologies of the organization, and determined its independence and APT attributes. The results of the investigation show that the organization has clear targets and rich experience in confrontation. There are still many mysteries to be explored.<\/p>\n\n\n\n

    The complex international relations in the Middle East lead to the generation of various APT organizations, many of which have a history of attacks against Turkey. NSFOCUS Security Labs will continue to pay attention to the activities and changes of MurenShark.<\/p>\n\n\n\n

    IoCs<\/h2>\n\n\n\n

    NiceRender ver.1<\/p>\n\n\n\n

    0a286239b3fe2e44545470e4117f66eb<\/p>\n\n\n\n

    88bba0077207359cdb9bddb3760f1f32<\/p>\n\n\n\n

    423cff633679c5dc1bfb27b4499eb171<\/p>\n\n\n\n

    NiceRender ver.2 partA<\/p>\n\n\n\n

    3592e56022ce1d87000e36cc0dd37d0e<\/p>\n\n\n\n

    bb9e1f1e5ef6f3f9f8de6d12d626c435<\/p>\n\n\n\n

    11a5c681e108cf84a2cc669e8204ac53<\/p>\n\n\n\n

    0a768a5c9f4714f7ca92545baf9f72c9<\/p>\n\n\n\n

    a92c6617aa28d4041c44f4b9cc3a5fa3<\/p>\n\n\n\n

    9a31e7918ae4de42c28d67e711802f58<\/p>\n\n\n\n

    NiceRender ver.2 partB<\/p>\n\n\n\n

    07e4844bde106bb6786e9e767d376408<\/p>\n\n\n\n

    9a0889667c89e592914e74916fd1ec56<\/p>\n\n\n\n

    468b3eaf031b5aef98b34b5ce39facad<\/p>\n\n\n\n

    c0f37db18293732872643994e12a4ad2<\/p>\n\n\n\n

    44da01a0a636a6fa3141c698f3bb2673<\/p>\n\n\n\n

    UniversalDonut<\/p>\n\n\n\n

    e6c1685e504fe1d05aa365c79a5e0231<\/p>\n\n\n\n

    32704a3fb28508e3b15bbbd28716ec76<\/p>\n\n\n\n

    dc60577efe1d18c05b7c90853bac4c86<\/p>\n\n\n\n

    349341fe3519a81c0178c5840009cf87<\/p>\n\n\n\n

    LetMeOut<\/p>\n\n\n\n

    156e197d7838558f44eed800b3b3ee8a<\/p>\n\n\n\n

    0f5b520120008ca6969ccad439020f98<\/p>\n\n\n\n

    d509145bcf4e6af3de1a746609c23564<\/p>\n\n\n\n

    156e197d7838558f44eed800b3b3ee8a<\/p>\n\n\n\n

    CobaltStrike Beacon<\/p>\n\n\n\n

    e4b353f731739487dd48e322bf540405<\/p>\n\n\n\n

    URIs<\/p>\n\n\n\n

    http[:]\/\/jc.neu.edu[.]tr\/apply<\/p>\n\n\n\n

    http[:]\/\/jc.neu.edu[.]tr\/r_main.js<\/p>\n\n\n\n

    http[:]\/\/bookstore.neu.edu[.]tr\/KGB%20Numaralari%20ve%20Gecerlilik%20Tarihleri.xlsx<\/p>\n\n\n\n

    http[:]\/\/bookstore.neu.edu[.]tr\/ara<\/p>\n\n\n\n

    d0g3.cachedns[.]io<\/p>\n\n\n\n

    <\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"

    Part 1: Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [1] Characteristics of Attack Tactics Use compromised sites: MurenShark tends to use compromised sites as the file server and the C&C server in the attack process. As shown in the last chapter, the organization used the Near East University site (Yakın […]<\/p>\n","protected":false},"author":6,"featured_media":20769,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[3],"tags":[],"class_list":["post-20772","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"acf":[],"yoast_head":"\nInvestigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2] - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2] - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"Part 1: Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy Characteristics of Attack Tactics Use compromised sites:\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2022-09-02T06:00:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-17T18:07:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/09\/murenshark.jpg\" \/>\n<meta name=\"author\" content=\"Jie Ji\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2] - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"Part 1: Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy Characteristics of Attack Tactics Use compromised sites:\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/09\/murenshark.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jie Ji\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/\"},\"author\":{\"name\":\"Jie Ji\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/1077d8fcd7e52c96f17a33b63a0d157b\"},\"headline\":\"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2]\",\"datePublished\":\"2022-09-02T06:00:40+00:00\",\"dateModified\":\"2026-04-17T18:07:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/\"},\"wordCount\":2377,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2022\\\/09\\\/murenshark.jpg\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/\",\"name\":\"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2] - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2022\\\/09\\\/murenshark.jpg\",\"datePublished\":\"2022-09-02T06:00:40+00:00\",\"dateModified\":\"2026-04-17T18:07:43+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2022\\\/09\\\/murenshark.jpg\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2022\\\/09\\\/murenshark.jpg\",\"width\":474,\"height\":379,\"caption\":\"Text \\\"Muren Shark\\\" on digital blue background.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2]\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/1077d8fcd7e52c96f17a33b63a0d157b\",\"name\":\"Jie Ji\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"caption\":\"Jie Ji\"},\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/jji\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2] - NSFOCUS","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/","og_locale":"pt_BR","og_type":"article","og_title":"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2] - NSFOCUS","og_description":"Part 1: Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy Characteristics of Attack Tactics Use compromised sites:","og_url":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/","og_site_name":"NSFOCUS","article_published_time":"2022-09-02T06:00:40+00:00","article_modified_time":"2026-04-17T18:07:43+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/09\/murenshark.jpg","type":"","width":"","height":""}],"author":"Jie Ji","twitter_card":"summary_large_image","twitter_title":"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2] - NSFOCUS","twitter_description":"Part 1: Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy Characteristics of Attack Tactics Use compromised sites:","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/09\/murenshark.jpg","twitter_misc":{"Escrito por":"Jie Ji","Est. tempo de leitura":"12 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/"},"author":{"name":"Jie Ji","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/1077d8fcd7e52c96f17a33b63a0d157b"},"headline":"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2]","datePublished":"2022-09-02T06:00:40+00:00","dateModified":"2026-04-17T18:07:43+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/"},"wordCount":2377,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/09\/murenshark.jpg","articleSection":["Blog"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/","url":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/","name":"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2] - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/09\/murenshark.jpg","datePublished":"2022-09-02T06:00:40+00:00","dateModified":"2026-04-17T18:07:43+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/09\/murenshark.jpg","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/09\/murenshark.jpg","width":474,"height":379,"caption":"Text \"Muren Shark\" on digital blue background."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/investigation-report-on-new-apt-organization-murenshark-torpedoes-fired-to-turkish-navy-2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"Investigation Report on New APT Organization MurenShark: Torpedoes Fired to Turkish Navy [2]"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/#website","url":"https:\/\/nsfocusglobal.com\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/1077d8fcd7e52c96f17a33b63a0d157b","name":"Jie Ji","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","caption":"Jie Ji"},"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/jji\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/20772","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=20772"}],"version-history":[{"count":0,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/20772\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/20769"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=20772"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=20772"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=20772"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}