MuddyWater’s Phoenix Backdoor Infects More Than 100 Government Organizations

According to Group-IB Threat Intelligence, MuddyWater’s Phoenix backdoor campaign targeted over 100 government entities across the Middle East, North Africa, and international organisations. The operation began with a phishing drive using a compromised mailbox accessed through a NordVPN exit node in France, with malicious Word attachments designed to prompt macro execution.

The real command-and-control infrastructure was hosted at 159.198.36[.]115 and provided post-exploitation tools, including a custom browser credential stealer, PDQ RMM, and Action1 RMM. After macros were enabled, the dropper FakeUpdate decrypted a second-stage payload that injected Phoenix backdoor version 4 into the attacker’s process, enabling reconnaissance and persistence.

The backdoor gained persistence by altering the Windows Registry, and later beaconed to the C2, while also collecting system information and supporting commands such as file transfer and remote monitoring. The malware samples include a hardcoded C2 domain, screenai[.]online, registered on 17 August 2025 and active for five days between 19 and 24 August 2025.