MuddyWater Deploys Custom Multi-Stage Malware Hidden Behind Cloudflare

Since early 2025, cybersecurity analysts have witnessed a marked evolution in the tactics and tooling of MuddyWater, the Iranian state-sponsored Advanced Persistent Threat (APT) group.

Historically known for broad Remote Monitoring and Management (RMM) campaigns, MuddyWater has pivoted to highly targeted spearphishing operations and bespoke backdoors.

This shift underscores the group’s growing sophistication and its intent to evade detection by blending custom malware with mainstream infrastructure services.

Through 2024, MuddyWater relied heavily on commercially available RMM platforms delivered via mass phishing emails, leveraging file-sharing services to host installers.

However, since January 2025 there has been a pronounced decline in these opportunistic campaigns. Instead, the group has focused on crafting minimalistic yet potent backdoors such as Phoenix and StealthCache, alongside PowerShell-based implants.

Phoenix operates by decrypting an embedded PE payload using a simple XOR routine and mapping it into memory, then initiating periodic HTTP communications to its C2 via “/register,” “/imalive,” and “/request” endpoints.

StealthCache, delivered through the Fooder loader, employs HTTPS requests to “/aq36” and “/rq13” endpoints for command retrieval and log exfiltration, leveraging alternate data streams to self-delete and avoid forensic artifacts.

This bespoke toolset grants MuddyWater granular control over compromised hosts while reducing their reliance on third-party software footprints.

Phishing and Malicious Documents

Despite the custom tooling, spearphishing with malicious Office documents retains its role as the primary infection vector.

The malware decrypts an embedded PE file using a simple XOR algorithm, maps it into its own process memory, and transfers execution to its entry point.

Recent incidents show attachments embedding macros that drop payloads into public directories before invoking side-loaded DLL loaders.

Analysts have noted multiple malicious documents—timestamped identically on July 25, 2024—to the Phoenix implant via shared mutex names and payload hash comparisons.

These documents masquerade as legitimate presentations or notifications, exploiting user trust by spoofing government and industry entities.

By maintaining this delivery consistency, MuddyWater ensures high targeting accuracy while minimizing detection during initial compromise.

MuddyWater’s infrastructure reflects a deliberate mix of mainstream cloud providers and bulletproof hosts.

Amazon Web Services remains a cornerstone for hosting benign-looking assets, while Cloudflare’s CDN and DDoS protections mask origin servers and impede traffic analysis.

Complementing these are commercial providers—M247, DigitalOcean, OVH—and resilient bulletproof services like Stark Industries.

Domain registrations primarily occur through Namecheap, using Let’s Encrypt and Google Trust certificates to lend legitimacy.

Passive DNS analysis of “netivtech[.]org,” a known C2 domain, reveals rapid IP transitions across SEDO GmbH and Cloudflare, illustrating the group’s practice of short-lived infrastructure.

Analysts leverage unique strings in HTTP banners—Werkzeug for StealthCache and Uvicorn for Phoenix—to pivot on shared backend technologies, uncovering new malicious endpoints before they are taken offline.

MuddyWater’s adaptive tradecraft, combining custom malware development with opportunistic use of open-source projects and commercial services, signals a maturing threat actor capable of precise espionage and disruption.

Security teams confronting evolving APT campaigns must therefore adopt proactive hunting measures, including spearphishing detection, macro-block policies, and certificate-based infrastructure pivots.

As MuddyWater refines its multi-stage payloads and obfuscation methods, collaboration between threat intelligence and incident response communities remains essential to mitigate future assaults.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.