Full Report
Group-IB Threat Intelligence has uncovered a sophisticated phishing campaign, attributed with high confidence to the Advanced Persistent Threat (APT) MuddyWater. The attack used a compromised mailbox to distribute Phoenix backdoor malware to international organizations and across the whole Middle East and North Africa region, targeting more than 100 government entities.
Analysis Summary
# Threat Actor: MuddyWater
## Attribution & Identity
* **Actor Name:** MuddyWater
* **Aliases:** Seedworm, TA450, Boggy Serpens, Earth Vetala.
* **Known Associations:** Attributed with high confidence to Iran’s Ministry of Intelligence and Security (MOIS). The group has been active since at least 2017.
## Activity Summary
Group-IB identified a sophisticated phishing campaign where MuddyWater utilized a compromised mailbox to distribute malware. The operation was characterized by a short, tightly controlled attack window (approximately five days) using newly registered infrastructure to deploy the Phoenix backdoor.
## Tactics, Techniques & Procedures
* **Initial Access:** Phishing via compromised legitimate mailboxes to increase trust.
* **Execution:** Use of malicious macros within documents to trigger the infection chain.
* **Persistence:** Establishing persistence via Windows Registry modifications (T1547.001).
* **Evasion:** Creating a mutex (`sysprocupdate.exe`) to ensure process uniqueness and avoid multiple instances.
* **Discovery:** Gathering host and system information upon initial execution (T1082).
* **Command and Control:** Communicating with C2 servers over WinHTTP to receive and execute remote commands (T1071.001).
* **Deployment:** Copying the backdoor to `C:\ProgramData\sysprocupdate.exe`.
## Targeting
* **Sectors:** Government entities (primary focus), energy, and telecommunications.
* **Geography:** International organizations, the Middle East, and North Africa (MENA) region.
* **Victims:** More than 100 government entities were targeted in this specific campaign.
## Tools & Infrastructure
* **Malware Families:**
* **Phoenix Backdoor (v4):** Used for host reconnaissance and executing attacker commands.
* **FakeUpdate:** Used in the initial stages of the infection.
* **PDQ RMM:** Legitimate Remote Monitoring and Management tool leveraged for unauthorized access.
* **Infrastructure:**
* **C2 Domain:** `screenai[.]online` (Registered 2025-08-17).
* **C2 IP:** `159[.]198[.]36[.]115` (Hosted behind Cloudflare).
## Implications
MuddyWater represents a sustained threat to geopolitical adversaries of Iran. Their focus on long-term espionage and intelligence gathering indicates that their goal is not immediate financial gain, but rather maintaining persistent access to strategic infrastructure for tactical disruption and data theft. The use of compromised legitimate mailboxes suggests an evolution in their social engineering tactics to bypass standard email security filters.
## Mitigations
* **Email Security:** Implement advanced Business Email Protection to detect anomalies in internal/compromised mailbox behavior and block malicious macros.
* **Registry Monitoring:** Audit and monitor changes to the Windows Registry, specifically keys related to "Run" and "RunOnce" persistence.
* **Endpoint Defense:** Deploy EDR/XDR solutions to detect the creation of unusual mutexes (e.g., `sysprocupdate.exe`) and unauthorized file writes to `C:\ProgramData\`.
* **Network Filtering:** Block known IoCs, including the domain `screenai[.]online` and the IP `159[.]198[.]36[.]115`.
* **User Training:** Educate employees on the dangers of enabling macros in documents, even those sent from supposedly trusted internal or regional government addresses.