MuddyWater strikes Israel with advanced MuddyViper malware

Iran-linked threat group MuddyWater targeted Israeli organisations and one Egyptian victim with a new MuddyViper backdoor, as described by ESET researchers. The operation, which ran from 30 September 2024 to 18 March 2025 and spanned sectors including engineering, local government, manufacturing, technology, transportation, utilities, and universities, used a Fooder loader disguised as a Snake game to deploy MuddyViper for system information theft, credential harvesting, and file execution.

Attackers also employed CE-Notes and LP-Notes stealers and go-socks5 reverse tunnels, with a low-profile approach that avoided interactive sessions and relied on the CNG Windows cryptographic API for data encryption. The campaign involved MuddyWater acting as an initial access broker, spearphishing with links to remote management software and loaders such as a Mimikatz loader and the VAX-One backdoor, and showed overlaps with OilRig’s subgroup in a February 2025 utilities victim.

According to the report, MuddyViper and related loaders reuse the CNG API and mimic Windows Security dialogs to steal credentials, reflecting a refined and increasingly stealthy Iranian-nexus toolkit.