Loading malware…
BugSleep is a custom backdoor associated with the Iranian MOIS-linked threat actor MuddyWater, also tracked as Static Kitten, Seedworm, Mango Sandstorm, Earth Vetala, and Boggy Serpens. Public reporting states it has been deployed since at least May 2024, primarily in phishing campaigns targeting Israeli organizations, with additional reporting tying related activity to Saudi Arabia, Egypt, and broader Middle East targeting across sectors including government, municipalities, airlines, travel, media, telecommunications, engineering, manufacturing, education, finance, and critical infrastructure.
BugSleep is described as a backdoor used to execute commands and transfer files between infected hosts and command-and-control servers. Reporting notes support for file exfiltration, writing file content, executing cmd via pipes, updating sleep/timeout values, stopping communications, and managing persistence. One source describes it as Python-based, while other reporting—explicitly cited as the first detailed analysis—describes it as a custom C/C++ backdoor; the latter is also linked to the alternate name MuddyRot used by Sekoia.
Observed delivery is via spear-phishing, often from compromised organizational email accounts, with malicious Office documents and macros as a recurring infection vector. MuddyWater also used legitimate file-sharing services such as Egnyte and, in parallel campaigns, legitimate remote management tools; later reporting states the group shifted from relying exclusively on RMM tools to deploying BugSleep and other custom implants. A custom Phoenix injector/loader has been reported deploying BugSleep, and forensic analysis tied BugSleep delivery to the "Phoenix Lineage" VBA builder track. Group-IB also reported BugSleep being used alongside the Fooder loader and Stealth Cache backdoor.
Technical reporting states BugSleep uses repeated Sleep API calls for anti-analysis delay, creates mutexes including "PackageManager" and "DocumentUpdater," decrypts configuration containing a C2 IP address and port, and uses byte-shift encryption for strings, configuration, and C2 traffic. Communications were described as using a [size_of_data][data] format and sending an initial victim identifier composed of computer name followed by username. Persistence commonly involves creation of a scheduled task named after the mutex, with the comment "sample comment," configured to run every 30 minutes daily. One version reportedly enabled ProcessSignaturePolicy (MicrosoftSignedOnly) and ProcessDynamicCodePolicy (ProhibitDynamicCode) to hinder DLL injection and dynamic code hooking.
A custom loader associated with BugSleep injects encrypted shellcode or loads the implant in memory into running processes including msedge.exe, chrome.exe, opera.exe, anydesk.exe, onedrive.exe/powershell.exe; one report specifically cites use of WriteProcessMemory and CreateRemoteThread for injection. Separate reporting also links BugSleep to APC-injection-related tradecraft. Additional reported indicators include the mutex "DocumentUpdater," TCP port 443, and matching string-obfuscation logic in samples tracked as MuddyRot.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Starting May 2024 it was noted shifting from exclusively using legitimate Remote Management Tools to deploying a custom backdoor they named BugSleep. BugSleep comes with a custom loader that injects encrypted shellcode into running instances of msedge.exe , chrome.exe , opera.exe , anydesk.exe , onedrive.exe and powershell.exe .
Starting May 2024 it was noted shifting from exclusively using legitimate Remote Management Tools to deploying a custom backdoor they named BugSleep. BugSleep comes with a custom loader that injects encrypted shellcode into running instances of msedge.exe , chrome.exe , opera.exe , anydesk.exe , onedrive.exe and powershell.exe .
17 distinct techniques documented for this family, organized by ATT&CK tactic.
"the malware then creates a scheduled task... The scheduled task, which ensures persistence for BugSleep, runs the malware and is triggered every 30 minutes"
“use of command and scripting interpreters (T1059) like PowerShell (T1059.001)” and repeated PowerShell-based backdoors (e.g., TameCat) and command lines across groups.
"the malware then creates a scheduled task... The scheduled task, which ensures persistence for BugSleep, runs the malware and is triggered every 30 minutes"
Process injection sits at the top of the MITRE ATT&CK heap for the second year running. Picus Labs’ Red Report 2025 found T1055 in roughly 31% of the million-plus malware samples they examined.
Hence APC injection was formed as a technique, they’d find a process with a thread in an alertable wait and get a handle to it, call VirtualAllocEx and WriteProcessMemory to plant shellcode and then call QueueUserAPC pointed at the shellcode, the thread would eventually wake up and execute the shellcode.
"All the configurations and strings are encrypted... Every message exchanged between BugSleep and its C&C domain follows this format"
Process injection sits at the top of the MITRE ATT&CK heap for the second year running. Picus Labs’ Red Report 2025 found T1055 in roughly 31% of the million-plus malware samples they examined.
Hence APC injection was formed as a technique, they’d find a process with a thread in an alertable wait and get a handle to it, call VirtualAllocEx and WriteProcessMemory to plant shellcode and then call QueueUserAPC pointed at the shellcode, the thread would eventually wake up and execute the shellcode.
Sekoia TDR (July 2024) independently documented the same implant under the name MuddyRot, with matching characteristics: mutex “DocumentUpdater,” TCP port 443, and identical string obfuscation logic.
Word lure (airline tickets, reports) -> HTTP_VIP -> AnyDesk (return to RMM abuse pattern).
"MuddyWater has frequently used Egnyte subdomains... Upon opening the shared link, recipients can see the name of the purported sender"
Recent attacks have also involved a variety of more sophisticated malware, including the BugSleep backdoor to facilitate file transfers between infected endpoints and C2 servers, a Phoenix injector for deploying BugSleep, the Fooder malware loader and an advanced backdoor tracked as Stealth Cache.
44 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom backdoor used with a loader that injects encrypted shellcode into running processes via APC-related process injection techniques.
A full backdoor delivered via the Phoenix Lineage VBA builder track and used in Boggy Serpens/MuddyWater campaigns for persistent access.
A malware remediation prompt constructed as “How should we address this computer with BugSleep malware? Give 5 discrete steps to remediate and prevent recurrence” applies chain-of-thought logic — breaking a complex problem into analyst-ready steps.
A custom C/C++ backdoor used in phishing campaigns across more than 10 sectors, with Sekoia tracking the same implant as MuddyRot.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.