MuddyWater
MuddyWater is an Iran-linked advanced persistent threat and associated malware/toolset active since at least 2017. The provided reporting describes sustained spear-phishing operations, including a 2018 campaign targeting government, military, telecommunications, and educational organizations, primarily across the Middle East, with victims observed in Jordan, Turkey, Iraq, Pakistan, Saudi Arabia, Afghanistan, Azerbaijan, and additional cases in Russia, Iran, Bahrain, Austria, and Mali. Infection commonly began with macro-enabled Word documents using geopolitical decoys and password-protected macros. In some cases, users were tricked into activating a fake text box to trigger VBA execution.
Observed execution chains dropped staged files under C:\ProgramData, including names such as EventManager.dll, EventManager.logs, WindowsDefenderService.ini, Defender.sct, DefenderService.inf, and ZIPSDK\InstallConfNT.vbs. Persistence was established via HKCU Run keys, including entries such as WindowsDefenderUpdater, or via scheduled tasks. The malware abused LOLBins and Microsoft-signed binaries including rundll32.exe, advpack.dll LaunchINFSection, scrobj.dll, mshta.exe, WMI, and Office applications to decode and launch obfuscated PowerShell payloads. One reported behavior disabled Office Macro Warnings and Protected View to facilitate subsequent malicious document execution.
The malware conducted victim reconnaissance and communicated with command-and-control infrastructure selected at random from an embedded URL array. If one C2 failed, it selected another, slept briefly, and retried. It queried api.ipify.org to determine the victim’s public IP address and sent encrypted host data to C2, including public IP, OS version, internal IP, machine name, domain name, and username. The server returned a victim identifier used in later command requests. Supported commands included file upload, screenshot capture, execution of secondary PowerShell stages via Excel DDE, Outlook COM with MSHTA, or Explorer COM interaction, reboot, shutdown, and a destructive clean function that wiped drives C through F and rebooted the system. Screenshot output was stored as a PNG in ProgramData.
Anti-analysis behavior was also reported. Variants checked running processes against a denylist including OllyDbg, ProcessHacker, Wireshark, Procmon, Autoruns, and ImmunityDebugger. Some samples triggered a BSOD via ntdll.dll NtRaiseHardError when analysis-tool checks matched. More recent reporting cited a MuddyWater operation dubbed Operation Olalampo that used Telegram bots for C2 and deployed new malware including the Rust backdoor CHAR, the downloaders GhostFetch and HTTP_VIP, and GhostBackDoor, primarily affecting organizations in the MENA region.
The content also notes that Microsoft linked MuddyWater to malware signed through the Fox Tempest malware-signing-as-a-service operation, alongside families such as Oyster, Lumma Stealer, and Vidar.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Below is a description of the malware extraction and execution flow, starting from the initial infection vector, running VBA code via a macro and then dropping the PowerShell code that establishes command-center communications, sends victim system information and then receives commands supported by the malware.
Fox Tempest’s operation — which included an authenticated portal and a drag-and-drop feature for rapid code signing — was directly linked to dozens of malware families, including Oyster, Lumma Stealer, MuddyWater, and Vidar.
Fox Tempest’s operation — which included an authenticated portal and a drag-and-drop feature for rapid code signing — was directly linked to dozens of malware families, including Oyster, Lumma Stealer, MuddyWater, and Vidar.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Defense Impairment
1 technique
Defense Impairment
The group operated as an enabler “upstream in the malware and ransomware supply chain” — not conducting attacks directly, but selling a malware-signing-as-a-service (MSaaS) offering that allowed cybercriminals to disguise malware as legitimate, trusted software. | The certificates allowed attackers to disguise malicious software as legitimate applications, helping malware bypass security filters.
IOCs tracked for this family
102 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named malware/tool family listed as deployed through Fox Tempest’s malware-signing service using fraudulent certificates.
A named malware/tooling family cited as linked to Fox Tempest’s fraudulent code-signing infrastructure.
Iran-nexus APT activity described as deploying multiple new malware components and using Telegram bots for C2 in a MENA-focused campaign.
A macro-delivered, multi-stage PowerShell backdoor used in espionage campaigns. It drops files into ProgramData, establishes persistence via HKCU Run or scheduled execution, disables Office protections, performs anti-analysis checks, registers the victim with C2 infrastructure, and supports commands including screenshot capture, payload execution via Excel/Outlook/Explorer, file upload/download, reboot, shutdown, and destructive cleaning of drives.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.