Iran-Linked MuddyWater Deploys UDPGangster Backdoor, Using UDP Protocol for Covert C2

A new campaign attributed to the Iranian-linked MuddyWater group has been revealed, deploying UDPGangster, a backdoor that communicates exclusively over UDP to enable covert C2. The operation targets government and critical infrastructure entities across Turkey, Israel and Azerbaijan, with infection starting from a spear-phishing email impersonating the Turkish Republic of Northern Cyprus Ministry of Foreign Affairs and a malicious Word document (seminer.doc) containing a VBA macro.

Once macros are enabled, UDPGangster seeks to evade traditional defenses by using UDP for all C2 communications and by performing anti-analysis checks to detect sandboxes or virtual machines. It copies itself to the %AppData%\RoamingLow directory as SystemProc.exe and creates a registry run key for persistence, granting remote command execution, file exfiltration and dynamic updates to its C2 address.

The campaign has been linked to MuddyWater (also known as Mango Sandstorm or Static Kitten), a group associated with MOIS, with FortiGuard Labs detailing the campaign.