Israeli institutions spanning the education, engineering, local government, manufacturing, technology, transportation and utility sectors have emerged as targets of a new set of attacks carried out by Iranian nation-state actors, giving rise to a previously unknown backdoor called MuddyViper.
This activity has been attributed by ESET to a hacking group called muddy water (aka Mango Sandstorm or TA450), a cluster believed to be affiliated with Iran’s Ministry of Intelligence and Security (MOIS). An Egypt-based technology company was also targeted in the attacks.
The hacking group first came to light in November 2017, when Palo Alto Networks Unit 42 used a custom backdoor called PowerStats to conduct wide-ranging targeted attacks against the Middle East between February and October that year. It is also known for devastating attacks on Israeli organizations using a Thanos ransomware variant called PowGoop as part of a campaign called Operation Quicksand.
According to data from the Israel National Cyber Directorate (INCD), Muddywater attacks are targeted at the country’s local authorities, civil aviation, tourism, healthcare, telecommunications, information technology and small and medium-sized enterprises (SMEs).
Typical attack chains include techniques such as spear-phishing and exploiting known vulnerabilities in VPN infrastructure to infiltrate networks and deploy legitimate remote management tools – a long-time favorite approach of Muddywater. However, since at least May 2024, phishing campaigns have introduced a backdoor called BugSleep (aka Muddyroot).
Some other notable tools in its arsenal include Blackout, a remote administration tool (RAT); AnchorRAT, a RAT that provides file upload and command execution features; CannonRat, a RAT that can receive commands and transmit information; Nestha, a known file infecting virus; and SAD C2, a command-and-control (C2) framework that provides a loader called TreasureBox, which deploys the BlackPearl RAT for remote control, and deploys a binary called Phoenix to download payloads from C2 servers.
The cyber espionage group has a track record of attacking a wide range of industries, particularly governments and critical infrastructure, using a mix of custom malware and publicly available tools. The latest attack sequence, like previous campaigns, begins with phishing emails containing PDF attachments that link to legitimate remote desktop tools such as Atera, Level, PDQ, and SimpleHelp.
The campaign is marked by the use of a loader called Fooder that is designed to decrypt and execute the C/C++-based MuddyViper backdoor. Alternatively, the C/C++ loader has also been found to deploy the go-sox5 reverse tunneling proxy and an open-source utility called hackbrowserdata To collect browser data from multiple browsers, with the exception of Safari in Apple macOS.
“MuddyWiper enables attackers to collect system information, execute file and shell commands, transfer files, and exfiltrate Windows login credentials and browser data,” the Slovak cybersecurity company said in a report shared with The Hacker News.
In total, the backdoor supports 20 commands that facilitate covert access and control of the infected system. Many versions of Fooder impersonate the classic Snake game, while incorporating delayed execution to avoid detection. Muddywater’s use of Fooder was first exposed by Group-IB in September 2025.
The following tools are also used in attacks −
- VAXOne, a backdoor that impersonates Veeam, AnyDesk, Xerox and OneDrive Updater Service
- CE-Notes, a browser-data stealer that attempts to bypass Google Chrome’s app-bound encryption by stealing the encryption key stored in the Chromium-based browser’s local state file (shares similarities with open-source) chrome elevator Project)
- Blob, a C/C++ browser-data-stealing tool that collects user login data from Google Chrome, Microsoft Edge, Mozilla Firefox, and Opera.
- LP-Notes, a credential stealer written in C/C++ that tricks users into entering their system username and password by displaying a fake Windows Security dialog.
“This campaign signals Muddywater’s growth in operational/online maturity,” ESET said. “The deployment of previously undocumented components – such as the Fooder Loader and MuddyWiper backdoor – indicates an effort to enhance stealth, persistence, and credential harvesting capabilities.”
cute kitten leaked
The disclosure comes just weeks after the Israel National Digital Agency (INDA) blamed Iranian threat actors known as APT42 for attacks targeting individuals and organizations of interest in an espionage-focused campaign called Spearspecter. APT42 is believed to share overlap with another hacking group tracked as APT35 (aka Charming Kittens and Fresh Felines).
This also follows a massive leak of internal documents that exposed the hacking group’s cyber operations, which, according to British-Iranian activist Nariman Gharib, feed into a system designed to locate and kill individuals deemed a threat to Iran. It is linked to the Islamic Revolutionary Guard Corps (IRGC), specifically its counterintelligence division known as Unit 1500.
FalconFeeds said, “The story sounds like a horror script written in Powershell and Farsi,” adding that the leak reveals “the full map of Iran’s IRGC Unit 1500 Cyber Division.”
The data dump was posted to GitHub by an unknown group in September and October 2025 kittenbustersWhose motivations remain unknown. Specifically, the group identifies Abbas Rahrovi, also known as Abbas Hosseini, as the leader of the operation and alleges that the hacking unit is managed through a network of front companies.
Perhaps one of the other most consequential revelations is the release of the entire source code associated with Bellacio, which was flagged by Bitdefender in April 2023 as having been used in attacks targeting companies in the US, Europe, the Middle East, and India. According to Gharib, the backdoor is the work of a team operating from the Shuhada base in Tehran.
DomainTools said, “The leaked material reveals a decentralized hacking collective, a structured command architecture rather than an organization with specific hierarchies, performance oversight, and bureaucratic discipline.”
“The APT35 leaks expose a bureaucratized cyber-intelligence apparatus, an institutionalized arm of the Iranian state with defined hierarchies, workflows, and performance metrics. The documents reveal a self-sustaining ecosystem where clerks log daily activity, measure phishing success rates, and track reconnaissance hours. Meanwhile, tech staff test and weaponize exploits against existing vulnerabilities.”
