Iran-Linked MuddyWater Deploys Phoenix v4 Backdoor via Compromised Emails and NordVPN Exit Node

According to Group-IB Threat Intelligence, the Iran-linked MuddyWater threat actor is deploying Phoenix backdoor version 4 alongside a FakeUpdate injector and a custom credential stealer disguised as a calculator, using compromised email accounts and legitimate VPN services to sustain access.

The campaign begins with phishing emails from compromised legitimate accounts that instruct victims to enable macros in Microsoft Word documents, after which VBA code drops a loader called FakeUpdate and injects Phoenix v4 into its own process. Once deployed, the backdoor registers the host with a command-and-control server and begins beaconing, enabling persistent remote control, with enhancements such as new persistence mechanisms and COM-based DLL loading.

Investigators traced the phishing infrastructure to a NordVPN exit node in France, and the C2 domain screenai[.]online was registered on 17 August 2025 via NameCheap and hosted on Cloudflare DNS, with the real IP 159.198.36[.]115 used to host the server and tools. The campaign also shows long-term access ambitions, including an open directory on the C2 server exposing RMM tools and a browser credential stealer, Chromium_Stealer, targeting several browsers and saving credentials to a local staging file.