'MuddyWater' Hackers Target Israeli Orgs With Retro Game Tactic

MuddyWater, one of Iran’s most active APTs, targeted Israeli organisations in a campaign that began on 30 September last year and concluded on 18 March this year, hitting 17 Israeli entities across universities, engineering firms, local government, and sectors including technology, transportation, utilities and manufacturing.

The group introduced a new loader that masquerades as a retro mobile game, specifically borrowing a mechanic from Snake to aid evasion, and deployed a backdoor named MuddyViper along with a trio of stealers and a loader called Fooder that reflectively loads payloads into memory. Fooder’s Snake-inspired design includes a delayed execution loop using Sleep API calls, and investigators note a header reading “Welcome to snake Game” in the code to disguise its context.

The analysis, published December 2025, suggests MuddyWater is evolving toward greater stealth, persistence, and credential harvesting capabilities, signalling a more refined approach than in earlier campaigns, according to ESET researchers. The report also describes a tendency to automate exploitation chains and to deploy both RMM tools and backdoors, indicating a shift in operational maturity for enterprises in the region to watch.