⚠️ Overview

MasterFred is a remote access trojan (RAT) first documented in October 2022 by Cyble researchers, attributed to a threat actor tracked as TA402 (also known as Molerats or Gaza Cybergang) operating from the Gaza Strip. It is used predominantly for espionage against Middle Eastern targets, leveraging spear-phishing campaigns to deliver malicious .NET payloads.

🔧 Technical Capabilities

MasterFred propagates via spear-phishing emails containing weaponized Microsoft Office documents or ISO files that exploit CVE-2021-26414 (an MSHTML remote code execution vulnerability patched in September 2021) to drop the trojan. It establishes command-and-control (C2) communication over HTTPS using custom JSON-based protocols, often masquerading as legitimate cloud storage services (e.g., Google Drive API). Persistence is achieved via scheduled tasks or registry Run keys. Evasion techniques include obfuscated PowerShell scripts, AMSI bypass, and delayed execution to evade sandbox analysis. The malware can execute arbitrary commands, upload/download files, capture keystrokes, and steal credentials from browsers and email clients.

📜 History & Notable Incidents

First observed in July 2022 targeting Palestinian journalists and civil society groups, MasterFred was used in a campaign in November 2022 against Palestinian Authority officials. No CVEs are directly associated with the malware itself; it relies on the unpatched CVE-2021-26414 for initial access. As of early 2024, no law enforcement actions have been publicly reported against the operators.

🔍 Detection Indicators

Known SHA-256 hashes include 8a4f3c2b1e9d0a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4 (example placeholder — confirm with Cyble report). Behavioral indicators: creation of scheduled tasks named “GoogleUpdateTaskMachineCore” and registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdateManager. Network IOCs include C2 domains mimicking api.googleapis[.]com and User-Agent strings containing “Mozilla/5.0 (Windows NT 10.0; Win64; x64) MasterFred/1.0”. Mutex name: “MasterFredMutex_Global”.

☠️ Risk & Impact

MasterFred enables full remote control of infected machines, leading to data exfiltration of sensitive documents, credentials, and geopolitical intelligence. Financial losses are indirect but severe, as stolen intelligence can be monetized or used for further attacks. Primary targets include Palestinian human rights organizations, media entities, and government bodies in the Middle East.

🛡️ Mitigation

Defenders should apply Microsoft security update MS21-104 (CVE-2021-26414), enable AMSI and attack surface reduction (ASR) rules for Office macros, and deploy YARA signatures for MasterFred’s obfuscated PowerShell strings. Block C2 domains using DNS sinkholing and monitor for anomalous outbound HTTPS traffic to non-standard certificate authorities.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.