Loading malware…
Small Sieve, also referred to as GRAMDOOR, is a simple Python-based backdoor associated with the Iran-aligned espionage group MuddyWater, which has been linked to the Iranian Ministry of Intelligence and Security. It has been used in broader MuddyWater intrusion activity targeting government and private-sector organizations across multiple regions, including telecommunications, defense, local government, and oil and gas environments.
The malware is distributed via a Nullsoft Scriptable Install System installer and establishes persistence by installing the backdoor and configuring it to run automatically at user logon. It has been observed masquerading as legitimate Microsoft-, Outlook-, or Windows Defender-related software, including the use of deliberate misspellings, as a defense-evasion measure.
Small Sieve functions as a backdoor that supports command-and-control through the Telegram Bot API over HTTPS, including SSL/TLS-protected communications. It can send and receive operator messages through Telegram-based infrastructure, using custom string and traffic obfuscation to hinder analysis and detection. Reported host reconnaissance behavior includes obtaining the identifier of the logged-in user. Samples have also been noted to require a specific command-line argument to execute correctly, indicating a basic execution guardrail.
Small Sieve is part of a wider MuddyWater malware ecosystem that has included PowGoop, Canopy or Starwhale, Mori, and POWERSTATS, and reflects the group’s long-running preference for lightweight backdoors, trusted services for command-and-control, and persistence mechanisms designed to blend into normal Windows activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A sample analyzed by the NCSC determined Small Sieve to be a Python backdoor distributed using a Nullsoft Scriptable Install System installer.
"Mandiant has named this backdoor GRAMDOOR due to its ability to use the Telegram Bot API for communication."
18 distinct techniques documented for this family, organized by ATT&CK tactic.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
These actors also maintain persistence on victim networks via tactics such as side-loading dynamic link libraries, to trick legitimate programs into running malware and obfuscating PowerShell scripts to hide command and control functions.
The malicious file impersonates a legitimate file that is signed as a Google Update executable file.
MuddyWater disguises malicious executables and uses filenames and Registry key names associated with Microsoft's Windows Defender to avoid detection during casual inspection... variations of Microsoft (e.g., "Microsift") and Outlook in its filenames associated with Small Sieve [T1036.005].
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
It says the Small Sieve's beacons and tasking are performed using Telegram API.
APT41 DUST used HTTPS for command and control. APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS. Lumma Stealer has used HTTPS for command and control purposes.
"APT28 has used Google Drive for C2."; "APT37 leverages social networking sites and cloud platforms ... for C2."; "FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2."
T1132.001 MuddyWater has used tools to encode C2 communications including Base64 encoding.
Small Sieve’s beacons and taskings are performed using Telegram API over Hypertext Transfer Protocol Secure (HTTPS) [T1071.001], and the tasking and beaconing data is obfuscated through a hex byte swapping encoding scheme combined with an obfuscated Base64 function [T1027], T1132.002].
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Python backdoor installed via an NSIS installer that establishes persistence through a registry run key and uses custom obfuscation plus the Telegram Bot API for beaconing and tasking.
Backdoor associated in the content with Telegram Bot API traffic from internal hosts.
Previously used MuddyWater malware family mentioned as historical background.
A MuddyWater-associated malware/tool documented in U.S. government advisory AA22-055A.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.