MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign

The Iranian hacking group MuddyWater has been observed deploying a new backdoor called UDPGangster, which uses UDP for its command-and-control communications in a targeted Turkey-Israel-Azerbaijan campaign. According to Fortinet FortiGuard Labs, the malware enables remote control of compromised systems, including command execution, file exfiltration, and deployment of additional payloads, all over UDP channels designed to evade traditional network defenses.

The campaign relies on spear-phishing emails featuring booby-trapped Microsoft Word documents that trigger macros, with some messages impersonating the Turkish Republic of Northern Cyprus Ministry of Foreign Affairs and inviting recipients to an online seminar titled “Presidential Elections and Results.” UDPGangster establishes persistence via Windows Registry modifications and

includes various anti-analysis checks, such as detecting debuggers, virtual machine indicators, RAM and MAC address attributes, and known sandbox tools, before proceeding to exfiltrate data to an external server over UDP port 1269. The payload decodes embedded data, writes it to a local file, and launches it with CreateProcessA, then uses macro-based droppers for initial access, while also dropping a Hebrew-language decoy image from Bezeq to mislead observers in November 2025. It negotiates to gather system information and exfiltrate through UDP, with the external server address listed as 157.20.182[.]75.