CE-Notes
CE-Notes is a credential- and browser-data stealer used by the Iran-aligned cyberespionage group MuddyWater (also tracked as Mango Sandstorm and TA450) in campaigns observed by ESET from 2024 onward. It was deployed post-compromise alongside other MuddyWater tooling such as the Fooder loader, the MuddyViper backdoor, LP-Notes, Blub, and reverse SOCKS5 tunneling utilities. High-confidence reporting states that CE-Notes targets Chromium-based browsers and is used to extract browser passwords, login credentials, and other sensitive data. Reporting also states that CE-Notes attempts to bypass Google Chrome's app-bound encryption by stealing the encryption key stored in the Local State file of Chromium-based browsers. ESET first observed CE-Notes in 2024. In the referenced MuddyWater activity, the broader intrusion set targeted organizations primarily in Israel, with at least one confirmed target in Egypt, including victims in technology, engineering, manufacturing, local government, education, and in some reporting telecom, government, oil, energy, transportation, utilities, and universities. Initial access in the campaign was typically achieved through spearphishing emails with PDF attachments that linked victims to legitimate remote monitoring and management tool installers hosted on free file-sharing services such as OneHub, Egnyte, and Mega. No standalone CE-Notes-specific indicators of compromise are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The threat actor also downloaded credential stealers tracked as CE-Notes and LP-Notes. Eset first observed CE-Notes in 2024.
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Browser-data stealer used in the described MuddyWater toolchain to collect browser-resident data.
Stealer used in the campaign (specific capabilities not detailed in the content).
Credential stealer used post-compromise to target Chromium-based browsers and harvest stored credentials/data.
A credential stealer used by MuddyWater. It shares the same design as LP-Notes and is used to steal credentials.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.