Snakes by the riverbank

ESET researchers have identified a new cyberespionage campaign by the Iran-aligned MuddyWater group targeting organizations in Israel and Egypt. The group uses custom malware tools, including a Fooder loader and the MuddyViper backdoor, employing advanced techniques such as CNG cryptography and reflective loading. The campaign focuses on critical infrastructure sectors and uses spearphishing emails with links to remote monitoring and management software to deliver its payloads. MuddyWater's toolset includes browser data stealers, credential stealers, and reverse tunneling tools, indicating enhanced stealth and credential harvesting capabilities.

• New Project CAV3RN .NET Native AOT communication moduleMalware2026-07-21
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16
• MATCHBOIL: New tricks, same old evil intentionsMalware2026-10-09
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMsMalware2026-10-07
• Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace companyMalware2026-09-18