This report analyzes the recent activities of the MuddyWater APT group, which primarily targets organizations in the Middle East. The group employs sophisticated spear-phishing techniques, often impersonating legitimate entities and using malicious documents to gain initial access. Their attacks focus on long-term infiltration and intelligence gathering rather than immediate disruption. The report details several attack cases from 2019 to 2026, highlighting the group's evolving tactics, including the abuse of legitimate remote management tools and the use of Rust-based malware. The analysis emphasizes the importance of endpoint detection and response (EDR) solutions in identifying and mitigating these threats, as traditional perimeter-based security measures prove insufficient against such advanced persistent threats.
MuddyWater, an Iran-aligned cyberespionage group, has been targeting critical infrastructure in Israel and Egypt with custom malware and improved tactics. The campaign uses previously undocumented tools like the Fooder loader and MuddyViper backdoor to enhance defense evasion and persistence. Fooder masquerades as a Snake game and uses game-inspired techniques to hinder analysis. MuddyViper enables system information collection, file manipulation, and credential theft. The group also employs browser-data stealers and reverse tunneling tools. This campaign demonstrates MuddyWater's evolution towards more sophisticated and refined approaches, though traces of operational immaturity remain. The group continues to pose a significant threat, particularly to government, military, telecommunications, and critical infrastructure sectors in the Middle East.
An analysis of threat clusters, dubbed UNG0801 or Operation IconCat, targeting Israeli organizations. The actors use socially engineered phishing lures in Hebrew, exploiting antivirus icon spoofing from well-known vendors like SentinelOne and Check Point. Two distinct infection chains were identified, both utilizing AV-themed decoys dropped by malicious Word and PDF documents. The first campaign deploys a PyInstaller-based implant called PYTRIC, capable of system-wide wipes and backup deletion. The second campaign uses a Rust-based implant named RUSTRIC, focusing on antivirus enumeration and system information gathering. Both campaigns share similar tactics but differ in their ultimate objectives, with the first aimed at destruction and the second at espionage.
UDPGangster, a UDP-based backdoor associated with the MuddyWater threat group, has been observed targeting users in Turkey, Israel, and Azerbaijan. The malware is delivered through malicious Microsoft Word documents with embedded VBA macros, employing sophisticated anti-analysis techniques to evade detection. The campaigns use phishing emails impersonating government entities and include decoy images to distract victims. UDPGangster installs persistence, collects system information, and communicates with its command and control server using UDP. The malware supports various commands for remote execution, file extraction, and payload deployment. Analysis reveals connections to previous MuddyWater operations and shared infrastructure with other known malware.
MuddyWater, an advanced persistent threat group, has deployed a sophisticated malware variant called MuddyViper targeting Israel. This malware campaign represents a continuation of MuddyWater's operations, known for espionage and cyber-espionage activities. Although the campaign is currently focused on Israel, the malware's capabilities and the group's history suggest potential risks to other regions, including Europe. MuddyViper is designed to evade detection and maintain persistence, enabling long-term access to compromised systems. The threat does not currently have known exploits in the wild beyond this campaign, and technical details remain limited. The medium severity rating reflects the malware's advanced nature but limited current scope. European organizations, especially those with ties to Israel or in geopolitical sensitive sectors, should be vigilant. Mitigation requires targeted threat hunting, enhanced monitoring for indicators of compromise, and network segmentation. Countries with strong cybersecurity infrastructures and geopolitical relevance to the Middle East are at higher risk. Given the malware's espionage focus, the impact on confidentiality is significant, while integrity and availability impacts are moderate.
ESET researchers have identified a new cyberespionage campaign by the Iran-aligned MuddyWater group targeting organizations in Israel and Egypt. The group uses custom malware tools, including a Fooder loader and the MuddyViper backdoor, employing advanced techniques such as CNG cryptography and reflective loading. The campaign focuses on critical infrastructure sectors and uses spearphishing emails with links to remote monitoring and management software to deliver its payloads. MuddyWater's toolset includes browser data stealers, credential stealers, and reverse tunneling tools, indicating enhanced stealth and credential harvesting capabilities.
MuddyWater, an Iranian cyber espionage group, is deploying DCHSpy, an Android surveillance malware, amid the Israel-Iran conflict. DCHSpy is distributed through malicious VPN apps promoted on Telegram and can collect extensive data including WhatsApp messages, contacts, SMS, files, location, call logs, audio recordings, and photos. Recent variants have improved data exfiltration capabilities, particularly targeting WhatsApp and specific files. The malware uses lures related to StarLink to exploit internet outages in Iran. It shares infrastructure with SandStrike, another Android malware targeting Bahá’í practitioners. This campaign poses significant espionage risks to Android users in targeted regions and conflict zones.
A targeted intrusion campaign impacting Israeli organizations has been identified, leveraging compromised internal email infrastructure to distribute phishing messages. The attack uses a multi-stage, PowerShell-based infection chain, culminating in the delivery of a remote access trojan (RAT). Key characteristics include a full PowerShell-based delivery chain, obfuscated payloads, evidence of lateral movement, and potential overlap with MuddyWater campaigns. The attack begins with phishing emails, progresses through a spoofed Microsoft Teams page, and uses social engineering to execute malicious PowerShell commands. The payload retrieves additional data, deploys a RAT, and establishes communication with a command and control server. The campaign demonstrates the effectiveness of living-off-the-land techniques, layered evasion, and adaptive C2 communication.
A phishing campaign exploiting the aftermath of a military conflict between Israel and Iran has been identified. The scam, using a fake domain 'lineageembraer.online', offers evacuation flights from Tel Aviv to New York on an Embraer Lineage 1000E business jet. The website presents unrealistic pricing and logistical details, aiming to steal personal and financial information from individuals seeking to flee the region. The operation uses fear and urgency tactics, offering seats at $2,166 USD, significantly below market rates for similar flights. The scheme involves a PDF with instructions hosted on a Shopify CDN, raising further suspicions. The campaign demonstrates how threat actors exploit crisis situations to target vulnerable individuals.
The Iranian threat group Educated Manticore, associated with the Islamic Revolutionary Guard Corps, has launched spear-phishing campaigns targeting Israeli journalists, cyber security experts and computer science professors. The attackers posed as fictitious assistants to technology executives or researchers, directing victims to fake Gmail login pages or Google Meet invitations. This allowed them to intercept passwords and 2FA codes, gaining unauthorized access to victims' accounts. The group used a custom phishing kit implemented as a Single Page Application built with React, supporting various Google authentication flows and enabling 2FA relay attacks. The infrastructure relied on over 130 unique domains resolving to multiple IP addresses. Despite increased exposure, Educated Manticore continues to pose a persistent threat, particularly to individuals in Israel during the Iran-Israel conflict escalation.
The Mimo intrusion set is exploiting CVE-2024-46483, a Remote Code Execution vulnerability in Craft CMS, to deploy webshells and execute malicious payloads. The attack chain includes downloading infection scripts and deploying a loader, cryptominer (XMRig), and residential proxyware (IPRoyal) for financial gain. The group uses unique identifiers such as '4l4md4r' and 'n1tr0' and has been linked to operators 'EtxArny' and 'N1tr0'. Detection can focus on unusual processes in temporary directories and kernel module changes. The campaign targets Craft CMS installations globally, with a focus on financially motivated exploitation rather than geopolitical objectives. The threat is medium severity due to the impact on confidentiality and availability, ease of exploitation via RCE, and the scope of affected web servers. Organizations using Craft CMS should prioritize patching and monitoring for indicators of compromise.
