Boggy Serpens Hits Diplomats, Critical Infrastructure in Espionage Waves
Boggy Serpens, also known as MuddyWater, has escalated its cyberespionage operations over the past year, focusing on diplomats and critical infrastructure organizations in a coordinated, multi-wave campaign.
Boggy Serpens has moved beyond its earlier noisy, high-volume phishing style to prioritize persistence and stealth in campaigns across the Middle East, Europe, the Caucasus, Central and Western Asia and South America.
Recent operations show a clear emphasis on government, diplomatic and critical infrastructure entities, with particular focus on energy, maritime, aviation, telecom and financial sectors in countries such as Israel, Turkey, Saudi Arabia, the UAE and Azerbaijan.
According to the report, Iran’s Ministry of Intelligence and Security (MOIS), the group now blends trusted relationship compromises, tailored social engineering, and AI-assisted tooling to achieve long-term, stealthy access to strategic targets.
Central to this evolution is a “trusted relationship compromise” model, where the group hijacks legitimate internal or partner accounts to send lures that easily bypass reputation-based and spam filtering controls.
A chronological overview of the phishing campaigns and specific regional entities targeted throughout the last year that we attribute with high confidence to Boggy Serpens.
Once access is secured, Boggy Serpens relies on custom-compiled toolkits to maintain footholds and laterally move through victim environments.
A defining example of this strategy is a sustained six‑month operation against a UAE-based marine and energy company with strategic links to regional energy supply chains and Saudi Aramco.
The infected document contains specific references to “Engineering, Construction & Marine Services” and local currency (AED), alongside legitimate-looking transaction codes like “Payroll Payments via WPS”.
Analysts observed four distinct waves from August 2025 through February 2026, each tailored to different business units, underlining a specific mandate to penetrate maritime and engineering infrastructure.
The first wave used engineering-themed Word documents referencing subsea pipelines, relying on blurred content and “Enable Content” prompts to launch malicious macros.
Later waves targeted finance and logistics teams with weaponized Excel spreadsheets spoofing internal financial records and consumption reports, as well as a detailed fake Air Arabia ticket that deployed new payloads like GhostBackDoor and the Nuso HTTP backdoor family.
Boggy Serpens’ toolset has expanded to include Rust-based backdoors such as BlackBeard, custom HTTP implants like Nuso, and UDP-based malware such as UDPGangster, all designed for resilient, evasive command and control.
The IP 157.20.182[.]75 hosting a unique web-based Python server on port 5000. We assess that the threat actor uses this server to deliver emails to targets.
BlackBeard, tracked by the Israeli National Cyber Directorate, communicates using standard HTTP status codes for tasking and embeds data in headers, complicating detection while abusing memory-safe Rust constructs to hinder reverse engineering.
UDPGangster relies on UDP channels to execute commands, exfiltrate data and deploy follow-on payloads while bypassing traditional TCP-focused defenses, and is typically delivered via macro-laden Office documents aligned to victim sectors and geographies.
Another Rust-based tool, LampoRAT (Olalampo), masquerades as a legitimate Kaspersky process and leverages the Telegram Bot API for C2, providing a streamlined shell over encrypted HTTPS traffic to attacker-controlled Telegram bots.
Operationally, Boggy Serpens continues to depend on sophisticated social engineering lures delivered from hijacked government and corporate mailboxes, including ministries of foreign affairs and telecom providers.
In documented cases, seminar invitations, HR notices and cybersecurity-themed documents were sent from compromised internal addresses with negative spam confidence levels, allowing them to evade email security checks by appearing as authenticated internal traffic.
Malicious documents often implement a dual-layer deception: once opened, blurred content urges users to enable macros under the guise of compatibility issues, after which Visual Basic for Applications (VBA) builders deploy payloads tied to two primary tracks – a full-featured Phoenix backdoor lineage and the lighter UDPGangster family.
Shared decryption routines, file paths and configuration artifacts link these tracks to a single, maturing development pipeline that increasingly uses AI-generated code and modern languages for rapid iteration.
The Boggy Serpens campaign illustrates how identity-centric compromise combined with AI-assisted malware development can sustain a high operational tempo against diplomats and critical infrastructure operators.
The suspicious content and thematic anomalies in the lure triggered Cortex XDR to flag this threat as high-risk, and prevent its execution before any user interaction could take place.
To counter this threat, organizations should enforce strict macro execution policies, closely monitor for anomalous behavior from trusted accounts and internal senders, and deploy behavioral analytics capable of detecting UDP-based C2 channels and HTTP status–driven implants.
Advanced detection and response platforms that correlate email telemetry, endpoint behavior and network signals are critical to disrupting secondary infection stages and preventing persistence by toolsets such as BlackBeard, Nuso, UDPGangster and LampoRAT.
Strengthening identity protection, hardening mail flows and hunting for signs of internal account hijacking are now essential for entities in diplomacy, energy, maritime, telecom and finance that may fall within Boggy Serpens’ expanding target profile.
| Lure Filename | First Seen | SHA256 Hash |
| Unknown file name | April 17, 2025 | c3afd5ce1ca50a38438bb5026cca27bfbf2d8e786e03f323adceb8ad17517eca |
| sh*t.doc (profanity masked) | July 24, 2025 | 52d8fb9a11920f27b9a3b43f27c275767a57cdffc95af94b7b66433506287314 |
| Online Seminar.FM.gov.om.doc | August 19, 2025 | b2c52fde1301a3624a9ceb995f2de4112d57fcbc6a4695799aec15af4fa0a122 |
| Online Seminar.MFA.gov.ct.tr (2).doc | August 19, 2025 | 1c16b271c0c4e277eb3d1a7795d4746ce80152f04827a4f3c5798aaf4d51f6a1 |
| Transfer receipt #27790.doc | August 11, 2025 | 4db3645f678fb519b9f529dde41f77944754f574f16a9a845c22d3703da5bed0 |
| DPR for dredging in FreeSpan_16082025.2.doc | August 16, 2025 | 2c92c7bf2d6574f9240032ec6adee738edddc2ba8d3207eb102eddf4ab963db0 |
| AIC_2025.doc | September 16, 2025 | 23f3a98befdff13c802eed32eea754018b8b525ec0dd3afce8459a0287df74ec |
| Middle East and Maritime Economy.doc | October 2025 | 69e038b9f3a228f09059bc1ce92b1c5c49396bb70987a38df0fdb39eed380b22 |
| sondouq.doc | October 2025 | 84e665a0dfbff74b4c356bfa282c7c253ae3411a8f4d58bfe121c8411c52552c |
| Webinar.doc (in Webinar.zip) | October/November 2025 | 6f079c1e2655ed391fb8f0b6bfafa126acf905732b5554f38a9d32d0b9ca407d |
| Scheduled_Internet_Outages.doc | November 2025 | 7ea4b307e84c8b32c0220eca13155a4cf66617241f96b8af26ce2db8115e3d53 |
| Cybersecurity.doc | January 2026 | f38a56b8dc0e8a581999621eef65ef497f0ac0d35e953bd94335926f00e9464f |
| Transaction Volumes Sheet_Filled.xls | February 2026 | 0ce54a5a6f061b158e3891aadd03773d0bae220b0316e84fc042a741924b3525 |
| Sajeev Saliha Beevi.doc | February 2026 | 167d5ab70f55c100e51833fbfea44048095889c162e1330df0631423fc547409 |
| Consumption Report (Jan 21 2025 – Feb 20 2026).xls | February 2026 | 4d2958d93d4650fc4a70f70663fe6943e8c11d61b2824512da296e8fd84e5bb9 |
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…