MuddyWater APT Shifts Tactics to Custom Malware

Group-IB analysts have released new intelligence on MuddyWater, the Iranian state‑sponsored APT linked to Tehran’s Ministry of Intelligence and Security, signalling a continued rise in operational sophistication. The report notes a shift away from widespread Remote Monitoring and Management intrusions towards a more targeted approach, with a heavy reliance on custom malware families such as Phoenix, StealthCache, BugSleep and Fooder, alongside PowerShell‑based implants.

Several newly weaponised tools are identified, including BugSleep, a backdoor capable of file transfers, interactive shells and persistence tasks; StealthCache, an advanced backdoor with credential theft features and anti‑analysis capabilities; and Phoenix, a lightweight backdoor using PowerShell for persistence and communicating with C2 servers via periodic “/iamalive” beacons. Fooder is described as a sophisticated loader employing DLL side‑loading and multi‑threading to evade detection.

Group-IB notes a deliberate mix of mainstream cloud and bulletproof hosting providers, with infrastructure analysis showing active use of AWS and the leveraging of Cloudflare to hinder analysis, alongside providers such as DigitalOcean, OVH, M247 and Stark Industries. Despite these precautions, MuddyWater continues to reuse TLS certificates and domains, enabling researchers to track campaigns across operations.