Loading story…
MuddyWater targeted organizations in Belarus, Turkey, and Ukraine with spear-phishing emails carrying Turkish-language Microsoft Word lure documents that used malicious macros to install malware. The initial document dropped a Delphi-based executable named CiscoAny.exe, established persistence through an .INF file and the Windows Run registry key, and collected host details before launching a second-stage Delphi payload. Researchers said the operation preserved strong overlaps with earlier MuddyWater tradecraft, including macro structure, function names, and delivery methods.
The second-stage malware checked internet connectivity, exfiltrated system information to 185.117.75[.]116.php, and pulled follow-on tasking from googleads.hopto[.]org, with POWERSTATS assessed as the likely next-stage payload. Check Point noted the campaign differed from prior MuddyWater activity because the second stage was not written in PowerShell, indicating the group was evolving its tooling while continuing parallel campaigns with at least two macro-generation approaches. The malware also used UPX packing and anti-analysis obfuscation to hinder detection and reverse engineering.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
A Palo Alto Networks LIVEcommunity post shared a Snort signature for detecting MoriAgent HTTP beaconing and multiple YARA rules for identifying MoriAgent and PowerStats malware artifacts associated with MuddyWater. The material described MoriAgent as a C++ MuddyWater implant and provided concrete detection logic for defenders.
The report states that MuddyWater has been active since at least 2017. This establishes the earliest known timeframe for the threat actor discussed in the campaign analysis.
Check Point Research analyzed a MuddyWater campaign targeting organizations in Belarus, Turkey, and Ukraine using Turkish-language malicious Word documents with macros. The campaign delivered Delphi-based malware, established persistence via an INF file and Run key, exfiltrated host data, and contacted command-and-control infrastructure for follow-on payloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iranian state-linked threat group **MuddyWater** targeted governments, ministries, universities, telecommunications providers, and other organizations in Turkey, the Arabian Peninsula, Pakistan, Armenia, and nearby countries with evolving espionage malware campaigns. Researchers said the group delivered malicious Excel and Office documents through phishing, using macros and the Office exploit `CVE-2017-0199` to launch multi-stage infections that dropped Windows Script Files, persistence components, and remote access tools including **SloughRAT**—also tracked as **Canopy**—along with additional Visual Basic and JavaScript implants. The intrusion chains used compromised or attacker-controlled infrastructure, regional decoy themes tied to Tajikistan, Pakistan, and Kurdistan, and fallback behavior that sometimes redirected victims to benign sites when command-and-control failed. Cisco Talos and Clearsky reported that MuddyWater combined PowerShell, living-off-the-land binaries, DNS and HTTP command-and-control, token-tracking mechanisms, and staged payload retrieval to execute arbitrary commands on victim systems, underscoring a broader shift toward more flexible and advanced tradecraft aligned with Iranian intelligence objectives.
Aug 14, 2026
Iran-linked **MuddyWater** (also tracked as **Seedworm**) was tied to an espionage campaign that compromised at least nine organizations across nine countries and four continents, hitting sectors including manufacturing, education, government, financial services, professional services, telecommunications, and an international airport. Researchers said the group used **DLL side-loading** with legitimate signed binaries such as `fmapp.exe` from Fortemedia and `sentinelmemoryscanner.exe` from SentinelOne to launch malicious DLLs, including the open-source **ChromElevator** tool for browser-data theft. One confirmed victim was a major South Korean electronics manufacturer, where the attackers reportedly maintained access for about a week, while earlier activity also targeted telecom providers in Egypt, Sudan, and Tanzania. The operators combined stealthy execution with a broad post-compromise toolkit, using **Node.js** to launch PowerShell payloads for reconnaissance, screenshot capture, privilege escalation, credential theft, and SOCKS5 reverse-proxy tunneling. Symantec also linked MuddyWater to the **MuddyC2Go** PowerShell framework, use of legitimate remote-management software **SimpleHelp**, and the publicly available **Venom Proxy** to maintain access and move through victim networks. Persistence was established through registry modifications, credentials were harvested through fake login prompts and registry hive dumping, and stolen data was exfiltrated via the public file-transfer service `sendit[.]sh`, indicating a sustained intelligence-collection effort aligned with Iranian state interests.
Jun 29, 2026
The Iranian state-linked threat actor MuddyWater has launched a cyber espionage campaign targeting organizations in Turkey, Israel, and Azerbaijan using a new backdoor named UDPGangster. This malware leverages the User Datagram Protocol (UDP) for command-and-control (C2) communications, enabling attackers to remotely control compromised systems, execute commands, exfiltrate files, and deploy additional payloads while evading traditional network defenses. The attack chain begins with spear-phishing emails impersonating government entities, such as the Turkish Republic of Northern Cyprus Ministry of Foreign Affairs, and includes malicious Microsoft Word documents that prompt users to enable macros, triggering the execution of the UDPGangster payload. The VBA macro embedded in the malicious documents decodes Base64-encoded data and writes it to a file, which is then executed to launch the backdoor. UDPGangster establishes persistence through Windows Registry modifications and incorporates anti-analysis techniques to resist detection and analysis. The campaign demonstrates MuddyWater's continued evolution in using covert communication channels and sophisticated social engineering tactics to infiltrate targeted organizations in the Middle East region.
Jun 29, 2026