Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage Campaign

The Iranian nation-state group MuddyWater has been attributed a global espionage campaign that targets more than 100 organisations, including embassies, diplomatic missions and foreign affairs bodies in the Middle East and North Africa. Security researchers have described the operation as using a compromised mailbox to distribute a backdoor called Phoenix, with a weaponised Word document delivery chain that prompts macros, enabling the Phoenix payload to run.

The campaign leverages NordVPN to access the compromised account and to send phishing emails that appear authentic, increasing the likelihood of recipients enabling macros and opening the malicious attachments. Two variants of Phoenix, Version 3 and Version 4, have been detected in the wild, and the backdoor is deployed via a loader named FakeUpdate that drops and decodes the AES-encrypted Phoenix payload.

MuddyWater, also named Boggy Serpens and several other aliases, is assessed to be affiliated with Iran’s MOIS; according to Group-IB, this campaign marks an intensified effort to gather intelligence and infiltrate high-value targets.