Iran-Linked Hackers Hits Israeli Sectors with New MuddyViper Backdoor in Targeted Attacks

Israeli entities across academia, engineering, local government, manufacturing, technology, transportation and utilities have been targeted in a new MuddyWater operation that delivers a previously undocumented backdoor named MuddyViper. The activity has been attributed by ESET to MuddyWater (aka Mango Sandstorm or TA450), a group assessed as affiliated with Iran’s MOIS.

The campaign uses phishing emails to begin intrusions and exploits known VPN vulnerabilities to infiltrate networks before deploying the MuddyViper backdoor via a loader called Fooder, which decrypts and executes the C/C++-based malware and can also deploy go-socks5 reverse tunneling proxies and an open-source utility called HackBrowserData. In addition to MuddyViper, the operation leverages a suite of tools, including VAXOne, CE-Notes, Blub and LP-Notes, aimed at browser-data theft and credential harvesting.

The backdoor itself reportedly supports 20 commands for covert access, and some Fooder variants impersonate the Snake game to evade detection, with MuddyWater’s use of Fooder first highlighted by Group-IB in September 2025. According to the Israel National Cyber Directorate, MuddyWater’s attacks have targeted local authorities, civil aviation, tourism, healthcare, telecommunications, IT and SMEs.