Loading malware…
FORELORD is a Windows remote access trojan associated with the Iranian state-linked espionage group commonly tracked as MuddyWater, also known as COBALT ULSTER, Seedworm, TEMP.Zagros, and Static Kitten. It was observed in late 2019 and early 2020 in campaigns targeting non-governmental organizations and government entities in the Middle East, as well as broader regional government targets including organizations in Turkey, Jordan, and Iraq. The malware has been used in espionage operations against government, telecommunications, oil and gas, education, and intergovernmental targets.
FORELORD has been delivered through spearphishing campaigns using ZIP archives containing malicious Excel documents with obfuscated macros. The infection chain uses script-based execution and persistence mechanisms, including registry autorun entries, and launches the payload through native Windows utilities. Once active, FORELORD provides remote access capability and communicates with its operators through a DNS-based command-and-control protocol that uses TXT records and DNS tunneling via legitimate recursive resolvers to reach attacker-controlled infrastructure. This communication design blends malicious traffic into normal DNS activity and supports defense evasion.
Post-compromise activity observed alongside FORELORD included credential theft and credential validation using additional tooling, as well as the establishment of secondary access channels through tunneling utilities that could facilitate remote administration. The malware is part of MuddyWater’s broader tradecraft of combining custom implants with publicly available offensive tools and heavily obfuscated phishing documents to support long-term intelligence collection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
安全研究人员在 RSA 大会上披露 MuddyWater 组织使用鱼叉邮件分发ForeLord，并实施了在2019 年中期至2020 年1 月中旬的APT 活动，其中ForeLord 是一个窃取凭据的工具；
"In late 2019/early 2020, CTU researchers observed COBALT ULSTER targeting non-governmental organizations (NGOs) and Middle Eastern governments using malware CTU researchers named FORELORD based on behavioral aspects of the malware's C2 communications."
"In late 2019/early 2020, CTU researchers observed COBALT ULSTER targeting non-governmental organizations (NGOs) and Middle Eastern governments using malware CTU researchers named FORELORD based on behavioral aspects of the malware's C2 communications."
"In late 2019/early 2020, CTU researchers observed COBALT ULSTER targeting non-governmental organizations (NGOs) and Middle Eastern governments using malware CTU researchers named FORELORD based on behavioral aspects of the malware's C2 communications."
6 distinct techniques documented for this family, organized by ATT&CK tactic.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously unobserved remote access trojan delivered via malicious Excel macro. Executed via rundll32.exe loading a DLL (e.g., Exchange.dll), persists via a registry run key/batch script, and uses a DNS-based C2 protocol leveraging DNS TXT records (DNS tunneling) with a response string ("lordlordlordlord") used as part of its C2 acknowledgement/logic.
Custom malware used by COBALT ULSTER against NGOs and Middle Eastern governments; named by CTU researchers based on its command-and-control communication behavior.
Custom malware used by COBALT ULSTER against NGOs and Middle Eastern governments; named by CTU researchers based on its command-and-control communication behavior.
MuddyWater RAT referenced as part of the actor's earlier DNS tunneling phase.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.