MuddyWater Targets 100+ Gov Entities in MEA With Phoenix Backdoor

The Iran-backed threat group MuddyWater is targeting more than 100 government-related organisations and other entities across the Middle East and Africa in a cyberespionage campaign that delivers a Phoenix backdoor through phishing emails, according to Group-IB. The campaign reportedly began on 19 August and relies on a compromised mailbox accessed through NordVPN to send messages that appear authentic.

The Phoenix backdoor, version 4, is dropped via a FakeUpdate injector and is designed to establish persistence, feed back to MuddyWater’s C2 infrastructure, and facilitate remote monitoring. Victims receive phishing emails containing blurred Microsoft Word documents that prompt recipients to enable macros, which then trigger a VBA dropper to write a loader to disk. In addition to Phoenix, the operation uses Chromium_Stealer and tools such as PDQ RMM and Action1 for persistence and remote control.

The researchers note that MuddyWater’s activity aligns with its broader aims of cyberespionage and geopolitical disruption, and Group-IB urges organisations to bolster email security, threat hunting, and endpoint controls to defend against such state-aligned actors.