VAX One
VAX One is a backdoor used by the Iran-aligned MuddyWater cyberespionage group, also tracked as Mango Sandstorm and TA450, which has been linked in reporting to Iran’s Ministry of Intelligence and National Security (MOIS). In the referenced activity, MuddyWater targeted organizations primarily in Israel, with at least one confirmed target in Egypt, including victims in the technology, engineering, manufacturing, local government, and education sectors. VAX One was deployed as part of this campaign alongside other custom tooling and credential theft components. The malware is specifically described as impersonating legitimate software and services, including Veeam, AnyDesk, Xerox, and the OneDrive updater service, indicating a masquerading strategy for evasion and plausibility. The provided content does not describe VAX One’s detailed command set or infection chain beyond its use by MuddyWater and its impersonation themes.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Among the tools deployed by MuddyWater operators is also the VAX One backdoor, named after the legitimate software which it impersonates: Veeam, AnyDesk, Xerox, and the OneDrive updater service.
Techniques & procedures
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Stealth
1 technique
Stealth
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor that impersonates legitimate software such as Veeam, AnyDesk, Xerox, and OneDrive updater to maintain persistence and evade detection.
Backdoor that impersonates legitimate software (e.g., Veeam, AnyDesk, Xerox, OneDrive updater) to blend into victim environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.