MuddyWater Targets Critical Infrastructure With Custom Malware and Evolving Tactics

ESET researchers have uncovered a sophisticated campaign by MuddyWater, an Iran-aligned cyber-espionage group, targeting critical infrastructure across the Middle East with a newly refined toolkit that demonstrates significant operational evolution.

The campaign, which ran from September 2024 through March 2025, primarily focused on organizations in Israel with one confirmed victim in Egypt, marking a departure from the group’s historically noisy and easily detectable operations.

MuddyWater, also tracked as Mango Sandstorm or TA450, has long been recognized for targeting government, military, and critical infrastructure sectors across telecommunications, energy, and utilities.

This latest campaign, however, represents a considerable advancement in technical sophistication and operational discipline.

Unlike previous activities characterized by broad targeting and relatively unsophisticated techniques, this operation demonstrates unprecedented precision in toolset development and deployment strategy.

New Custom Malware Arsenal

The centerpiece of this campaign involves previously undocumented custom tools designed to enhance defense evasion and persistence capabilities significantly.

The Fooder loader, a 64-bit C/C++ tool, marks a notable technological shift for the group. Several Fooder variants masquerade as the classic Snake game, incorporating the game’s core mechanics as an evasion technique.

The loader implements custom delay functions combined with frequent Sleep API calls to hinder automated malware analysis systems, deliberately slowing execution to evade detection.

Fooder’s primary function involves reflectively loading the MuddyViper backdoor into memory without writing to disk, enabling a highly stealthy deployment mechanism.

MuddyViper, a newly identified C/C++ backdoor, provides comprehensive command and control capabilities, including system reconnaissance, credential harvesting, file operations, and shell command execution.

The backdoor supports 20 distinct commands enabling reverse shell operations, browser data exfiltration, and fake credential prompts designed to trick users into revealing sensitive information.

A particularly notable technical advancement involves the adoption of CNG (Cryptography Next Generation), Microsoft’s next-generation cryptographic API.

This represents the first documented instance of Iran-aligned groups utilizing this modern encryption standard, distinguishing MuddyWater from broader threat actors in the landscape.

Both MuddyViper and related data stealer variants employ AES-CBC encryption via the CNG API, substantially improving operational security beyond their typical publicly available tool deployments.

The campaign also leveraged credential stealers including CE-Notes and LP-Notes, both designed to harvest browser data and Windows credentials.

CE-Notes specifically targets app-bound encryption introduced in Chrome version 127, reflecting the group’s awareness of contemporary browser security mechanisms.

The tools deliberately avoided hands-on-keyboard interactive sessions historically a noisy technique prone to detection suggesting enhanced operational discipline.

Operational Implications

The victimology reveals a diversified targeting strategy across multiple critical sectors. Israeli organizations dominated the targeting scope, including engineering firms, local government entities, manufacturing companies, utilities, universities, and transportation infrastructure.

This concentrated focus on a single nation’s critical infrastructure suggests strategic geopolitical objectives aligned with Iran’s interests.

LP-Notes uses string stacking for strings shorter than 15 or longer than 19 characters, including the decryption key, IV, and import names. 

ESET researchers identified an unprecedented operational overlap between MuddyWater and Lyceum, an OilRig subgroup, in January and February 2025.

MuddyWater conducted initial access through spearphishing emails containing links to Syncro remote monitoring and management software.

Following compromise, operators deployed additional RMM tools and custom Mimikatz loaders before transferring access to Lyceum operators.

This cooperation suggests MuddyWater may now function as an initial access broker for other Iran-aligned threat actors, fundamentally altering the group’s operational model.

Despite these advancements, characteristics of operational immaturity persist. MuddyViper generates extremely verbose status messages and maintains a hardcoded list of 150+ security tool process names, resulting in substantial network traffic that could facilitate detection.

The group’s continued reliance on predictable spearphishing tactics and publicly available RMM tools demonstrates that technical advancement has not eliminated traditional attack vectors.

The campaign’s evolution from noisy, easily detectable operations to increasingly refined attacks poses escalating challenges for defenders.

ESET assesses that MuddyWater will remain a leading actor in Iranian-nexus espionage activities, with continued patterns of typical campaigns enhanced by progressively advanced techniques.

Organizations in government, telecommunications, and critical infrastructure sectors should prioritize monitoring for spearphishing emails containing RMM software links and implement robust detection for reflective loading techniques and credential theft activities.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.