The researchers identified novel tools employed by the group, including the Fooder loader and the MuddyViper backdoor, designed to improve evasion and persistence. The campaign uses remote monitoring & management software for initial access and adopts various credential stealers
Researchers of ESET, a global leader in the cybersecurity market, have identified new MuddyWater activity directed primarily against organizations in Israel, with a confirmed target in Egypt. The victims in Israel were from the technology, engineering, manufacturing, local government and education sectors. MuddyWater, also known as Mango Sandstorm or TA450, is an Iranian-aligned cyberespionage group known for persistent targeting of government sectors and critical infrastructure; It often uses custom malware and publicly available tools and is linked to Iran's Ministry of Intelligence and National Security. In this campaign, attackers deployed a set of customized and previously undocumented tools with the goal of improving evasion defense mechanisms and persistence. The new MuddyViper backdoor allows attackers to collect system information, execute file and shell commands, transfer files, and exfiltrate Windows login credentials and browser data. The campaign also uses additional tools dedicated to credential theft. Among these is Fooder, a custom loader that masquerades as an application similar to the classic Snake game.
In this campaign, initial access typically occurs via spearphishing emails, often containing PDF attachments that link to remote monitoring and management (RMM) software installers hosted on free file sharing platforms such as OneHub, Egnyte or Mega. These links lead to downloads of tools like Atera, Level, PDQ, and SimpleHelp. The tools distributed by MuddyWater operators also include the VAX One backdoor, which takes its name from the legitimate software it impersonates: Veeam, AnyDesk, Xerox and the OneDrive update service.
The group's continued reliance on this established approach makes its activity relatively easy to detect and block. However, in this case the group used more advanced techniques to deploy MuddyViper, a new backdoor, via a loader (Fooder) that loads the backdoor directly into memory, avoiding the normal file loading process and reducing the chances of detection, and then starting its execution. Different versions of Fooder masquerade as a Snake game, hence the designation MuddyViper. Another notable feature of Fooder is the frequent use of a custom delay function that implements the core logic of the Snake game, combined with calls to the “Sleep” API. These features aim to delay execution in an attempt to hide malicious behavior from automatic analysis systems. Additionally, MuddyWater developers have adopted CNG, a next-generation Windows cryptographic API, an unusual choice for Iranian-aligned groups and generally uncommon in the broader threat landscape. During this campaign, operators deliberately avoided hands-on-keyboard interactive sessions, a historically traceable technique often characterized by incorrectly typed commands. Therefore, while some components remain easily detectable, as is typical of MuddyWater, overall this campaign shows signs of technical evolution: greater precision, more strategic targeting and a more advanced toolset.
The post-compromise toolset also includes several credential theft tools: CE-Notes, which targets Chromium-based browsers; LP-Notes, which collects and organizes stolen credentials; and Blub, which steals login data from Chrome, Edge, Firefox, and Opera.
MuddyWater was first presented to the public in 2017 by Unit 42, whose analysis is consistent with ESET's profiling: a focus on cyberespionage, the use of malicious document attachments designed to push users to enable macros and bypass security controls, and targeting focused primarily on entities located in the Middle East.
Relevant previous activities include Operation Quicksand (2020), a cyberespionage campaign targeting Israeli government entities and telecommunications organizations, illustrating the group's evolution from basic phishing tactics to more advanced, multi-stage operations; and a campaign that directed its activities at political groups and organizations in Turkey, demonstrating the group's geopolitical focus, ability to adapt social engineering techniques to local contexts, and reliance on modular malware and flexible C&C infrastructures.
ESET has documented numerous campaigns attributed to MuddyWater that highlight the evolution of the toolset and the changing operational approach of the group. In March and April 2023, MuddyWater struck an unidentified victim in Saudi Arabia; furthermore, the group conducted a campaign between January and February 2025 characterized by significant operational overlap with Lyceum (a subgroup of OilRig). This cooperation suggests that MuddyWater could act as an initial access broker for other Iran-aligned groups.
