Full Report
Huntress has identified and detailed a full timeline of an intrusion in a customer environment that aligns with what others have identified as MuddyWater (Iranian-linked APT).
Analysis Summary
# Threat Actor: MuddyWater
## Attribution & Identity
* **Actor Name:** MuddyWater
* **Affiliation:** Iranian-linked Advanced Persistent Threat (APT) group.
* **Aliases/Associations:** Often identified as state-aligned clusters (e.g., Mango Sandstorm, Static Kitten).
* **Reported Links:** Specifically linked via infrastructure to indicators previously documented by Group-IB (Operation Olalampo) and Hunt.io.
## Activity Summary
The recent intrusion (identified in early 2026) involved a multi-stage attack against an Israeli entity. The threat actor utilized RDP for initial entry, followed by the establishment of multiple SSH tunnels for persistence and command-and-control (C2) stability. The campaign was notable for the actor’s use of DLL side-loading to bypass security controls and the apparent manual nature of their activity, evidenced by typos in command-line execution.
## Tactics, Techniques & Procedures
* **Initial Access:** Terminal Services/Remote Desktop Protocol (RDP) login.
* **Persistence & Evasion:**
* **DLL Side-Loading:** Abuse of the legitimate Fortemedia Inc. application `FMAPP.exe` to load a malicious `FMAPP.dll`.
* **Process Tree Grooming:** Opening fresh PowerShell sessions directly from `Explorer.exe` to blend in with legitimate interactive user behavior.
* **Command and Control:**
* Establishing SSH tunnels via `ssh.exe` to forward ports (e.g., 10841, 8585).
* **Discovery:**
* System Owner/User Discovery: `whoami /priv`
* Permission Groups Discovery: `net group "admi" /do`, `net localgroup administrators`.
* Process Discovery: `tasklist | findstr FMAPP`.
* **MITRE ATT&CK IDs:**
* T1021.001 (Remote Desktop Protocol)
* T1574.002 (DLL Side-Loading)
* T1059.001 (PowerShell)
* T1572 (Protocol Tunneling)
* T1033 (System Owner/User Discovery)
## Targeting
* **Sectors:** Technology, Defense, and general corporate environments.
* **Geography:** Primarily Israel (based on this specific case study) and other Middle Eastern regions.
* **Victims:** An unnamed Israeli company.
## Tools & Infrastructure
* **Malware:**
* Custom malicious DLL (`FMAPP.dll`).
* Legitimate binaries used for side-loading (`FMAPP.exe`).
* **Utilities:** OpenSSH (`ssh.exe`), PowerShell, Windows Command Processor (`cmd.exe`).
* **Infrastructure:**
* **SSH Tunneling IP:** 162.0.230[.]185
* **C2 IP:** 157.20.182[.]49
* **C2 Username:** asuedulimit
## Implications
MuddyWater continues to be a high-tempo threat to Israeli interests, utilizing a mix of "living off the land" techniques and legitimate software abuse to evade detection. The presence of manual command typos suggests that while the group is sophisticated in its tool selection, the operations are often hands-on, providing defenders an opportunity to detect "human" errors in the attack chain.
## Mitigations
* **RDP Security:** Enforce Multi-Factor Authentication (MFA) for all RDP sessions and restrict access via VPN or IP whitelisting.
* **Execution Prevention:** Monitor or block the execution of known vulnerable binaries used for side-loading (like older versions of `FMAPP.exe`) if not required for business operations.
* **Network Monitoring:** Alert on outgoing SSH traffic from unauthorized internal endpoints to external IP addresses, especially those involving reverse tunneling flags (`-R`).
* **Endpoint Detection:** Monitor for common reconnaissance commands (`whoami`, `net localgroup`) originating from suspicious parent processes like RDP-linked PowerShell sessions.