New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global Targets

On October 23, 2025, Group-IB Threat Intelligence reported a sophisticated phishing campaign by the Iran-linked APT group MuddyWater, targeting global organizations to gather intelligence. The campaign involved accessing a compromised mailbox via NordVPN to send phishing emails that appeared legitimate, tricking recipients into enabling macros in Microsoft Word documents. This action deployed the Phoenix backdoor, allowing remote control and data collection.

Group-IB attributes the campaign to MuddyWater based on malware indicators and targeting patterns, which include government and influential organizations, particularly in the Middle East, Europe, Africa, and North America. The report highlights the evolving tactics of MuddyWater, including the use of custom tools for credential theft and remote management, indicating a sustained focus on governmental targets amid geopolitical tensions.