DarkBeatC2
DarkBeatC2 is a backdoor/C2 malware associated with the Iranian threat actor MuddyWater, also referred to in the provided content as Static Kitten and linked to Iran’s MOIS. The content states that DarkBeatC2 is part of MuddyWater’s malware arsenal alongside PhonyC2, MuddyC2Go, PowerStats, and MoriAgent. It was reportedly used in 2024 phishing campaigns targeting Israeli entities, including operations described as using DarkBeatC2 together with the BugSleep backdoor. The supporting material ties its use to phishing-based intrusion activity against Israeli targets; no additional technical execution details, persistence mechanisms, or indicators of compromise specific to DarkBeatC2 are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Beyond using RMM software, "the attackers possess a vast arsenal of other malicious programs, including DarkBeatC2, PhonyC2, MuddyC2Go, PowerStats and MoriAgent," 360 said at the time.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Multiple Iran-nexus APT groups are described as using spear-phishing: e.g., Charming Kitten uses “spear-phishing with fake personas and compromised emails… phishing via benign PDFs for credential harvesting”; several others use “spear-phishing with malicious documents/attachments/links.”
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor used in phishing campaigns to provide command-and-control capability and persistence.
A malicious program in MuddyWater's arsenal used for command-and-control purposes.
Backdoor malware used by Static Kitten (MuddyWater) for persistent access and espionage.
Named command-and-control framework referenced in relation to MuddyWater activity and potential collaboration/hand-off between Iranian threat actors.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.