Loading story…
The Iranian state-linked threat actor MuddyWater has launched a cyber espionage campaign targeting organizations in Turkey, Israel, and Azerbaijan using a new backdoor named UDPGangster. This malware leverages the User Datagram Protocol (UDP) for command-and-control (C2) communications, enabling attackers to remotely control compromised systems, execute commands, exfiltrate files, and deploy additional payloads while evading traditional network defenses. The attack chain begins with spear-phishing emails impersonating government entities, such as the Turkish Republic of Northern Cyprus Ministry of Foreign Affairs, and includes malicious Microsoft Word documents that prompt users to enable macros, triggering the execution of the UDPGangster payload.
The VBA macro embedded in the malicious documents decodes Base64-encoded data and writes it to a file, which is then executed to launch the backdoor. UDPGangster establishes persistence through Windows Registry modifications and incorporates anti-analysis techniques to resist detection and analysis. The campaign demonstrates MuddyWater's continued evolution in using covert communication channels and sophisticated social engineering tactics to infiltrate targeted organizations in the Middle East region.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that MuddyWater deployed a new backdoor named UDPGangster that uses the UDP protocol for covert command-and-control communications. The malware establishes persistence, performs anti-analysis checks, and can exfiltrate data, execute commands, and deliver additional payloads.
The Iran-linked threat actor MuddyWater was observed conducting a targeted campaign against users in Turkey, Israel, and Azerbaijan using spear-phishing emails impersonating official entities. The emails delivered malicious Word documents that required macro activation to begin the infection chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Iranian state-sponsored threat group MuddyWater has conducted a widespread cyber espionage campaign targeting over 100 government and international organizations, primarily in the Middle East and North Africa. The attackers leveraged compromised email accounts accessed through NordVPN exit nodes to distribute phishing emails containing malicious Word documents. These documents, when opened and macros enabled, deployed the FakeUpdate malware loader, which subsequently decrypted and installed the Phoenix v4 backdoor on victim systems. The campaign focused on diplomatic entities such as embassies, consulates, and ministries of foreign affairs, with the attackers adapting their techniques to bypass modern security controls, including the use of macro-based payloads despite Microsoft's default macro restrictions. Researchers observed that after an initial phase using a command-and-control server, MuddyWater shifted tactics, likely employing additional tools and malware to further their espionage objectives. The Phoenix v4 backdoor, central to this operation, enabled persistent access and data exfiltration from compromised networks. The campaign highlights MuddyWater's continued evolution in attack methods and its focus on high-value government targets through sophisticated phishing and malware deployment strategies.
Jun 29, 2026
Iranian state-linked threat group **MuddyWater** targeted governments, ministries, universities, telecommunications providers, and other organizations in Turkey, the Arabian Peninsula, Pakistan, Armenia, and nearby countries with evolving espionage malware campaigns. Researchers said the group delivered malicious Excel and Office documents through phishing, using macros and the Office exploit `CVE-2017-0199` to launch multi-stage infections that dropped Windows Script Files, persistence components, and remote access tools including **SloughRAT**—also tracked as **Canopy**—along with additional Visual Basic and JavaScript implants. The intrusion chains used compromised or attacker-controlled infrastructure, regional decoy themes tied to Tajikistan, Pakistan, and Kurdistan, and fallback behavior that sometimes redirected victims to benign sites when command-and-control failed. Cisco Talos and Clearsky reported that MuddyWater combined PowerShell, living-off-the-land binaries, DNS and HTTP command-and-control, token-tracking mechanisms, and staged payload retrieval to execute arbitrary commands on victim systems, underscoring a broader shift toward more flexible and advanced tradecraft aligned with Iranian intelligence objectives.
Aug 14, 2026
MuddyWater targeted organizations in **Belarus, Turkey, and Ukraine** with spear-phishing emails carrying Turkish-language Microsoft Word lure documents that used malicious macros to install malware. The initial document dropped a Delphi-based executable named `CiscoAny.exe`, established persistence through an `.INF` file and the Windows **Run** registry key, and collected host details before launching a second-stage Delphi payload. Researchers said the operation preserved strong overlaps with earlier MuddyWater tradecraft, including macro structure, function names, and delivery methods. The second-stage malware checked internet connectivity, exfiltrated system information to `185.117.75[.]116.php`, and pulled follow-on tasking from `googleads.hopto[.]org`, with **POWERSTATS** assessed as the likely next-stage payload. Check Point noted the campaign differed from prior MuddyWater activity because the second stage was not written in PowerShell, indicating the group was evolving its tooling while continuing parallel campaigns with at least two macro-generation approaches. The malware also used **UPX packing** and anti-analysis obfuscation to hinder detection and reverse engineering.
Aug 15, 2026