Loading malware…
Venom Proxy is a proxying utility used in intrusion operations associated with the Iranian espionage threat actor commonly tracked as MuddyWater, also known as Seedworm and several other aliases. It has been described as one of the group’s preferred tools and has been observed alongside a broader toolset that includes remote administration software, PowerShell-based implants, credential-access tooling, and other tunneling utilities.
Observed use of Venom Proxy places it in campaigns targeting telecommunications and media organizations, including activity in Africa and other regions affected by MuddyWater operations. In these intrusions, the tool was deployed after compromise as part of hands-on-keyboard post-exploitation, enabling the operators to establish proxying or pivoting capability within victim environments. Its use has been reported together with remote access tools such as SimpleHelp and AnyDesk, as well as other proxy mechanisms, indicating a role in maintaining operator connectivity and facilitating movement or access deeper into compromised networks.
Available reporting supports classifying Venom Proxy as an attacker utility used primarily for post-compromise network access and tunneling rather than as an initial infection payload. High-confidence public attribution links its operational use to MuddyWater/Seedworm espionage activity against sectors including telecommunications, government, oil and gas, education, and related strategic targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A custom build of the Venom Proxy hacktool was also executed on this network, as well as the new custom keylogger used by the attackers in this activity.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A publicly available multi-hop proxy tool written in Go, used by Seedworm in custom builds to proxy traffic and manage intranet nodes inside victim environments.
Named proxy/pivoting tool listed among COBALT ULSTER tooling.
Named proxy/pivoting tool listed among COBALT ULSTER tooling.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.