Iran's 'MuddyWater' Levels Up With MuddyViper Backdoor

Iran’s MuddyWater has evolved its toolkit, adopting memory‑only loaders and a previously undocumented backdoor to pursue stealthier espionage, according to ESET researchers in a report issued this week. The group used a new 64‑bit loader named “Fooder” to decrypt and execute payloads entirely in memory, deploying a backdoor called “MuddyViper” that gives extensive control over compromised systems.

MuddyWater’s operation ran from late September 2024 through mid‑March 2025, focused mainly on Israeli organisations with at least one confirmed victim in Egypt, and involved custom credential stealers such as CE‑Notes, LP‑Notes and Blub. The attackers used reverse tunnels to siphon data to attacker‑controlled systems and relied on Microsoft's Cryptography API Next Generation (CNG) for encryption, suggesting more sophisticated development capabilities.

Notably, the campaign overlapped with Lyceum, another Iran‑aligned actor, with MuddyWater acting as an initial access broker in at least one instance. MuddyWater has long targeted government, military and critical infrastructure sectors, and this campaign marks a shift toward more refined tradecraft while traces of operational immaturity remain, according to the same report.