MuddyWater Deploys Custom Multi-Stage Malware Hidden Behind Cloudflare

Since early 2025, MuddyWater, the Iranian state-sponsored APT, has evolved its tactics from broad RMM campaigns to targeted spearphishing and bespoke backdoors, the article notes. The group now deploys custom, multi-stage malware hidden behind mainstream infrastructure services, reducing reliance on third-party software footprints.

Phoenix and StealthCache are highlighted as minimal yet potent backdoors, with Phoenix decrypting an embedded PE payload via a simple XOR routine and mapping it into memory before contacting its C2 at the endpoints /register, /imalive and /request. StealthCache, delivered through the Fooder loader, uses HTTPS requests to /aq36 and /rq13 for command retrieval and exfiltration, employing alternate data streams to self-delete.

Despite the tooling, spearphishing with malicious Office documents remains the primary infection vector, with attackers sometimes embedding macros to drop payloads into public directories before side-loading DLLs. The group also mixes infrastructure across Amazon Web Services and Cloudflare to mask origins, while domain registrations commonly use Namecheap and Let’s Encrypt certificates to appear legitimate.