Penelope Iroko Table of Contents
MuddyViper backdoor attacks are hitting Israeli academia, manufacturing, utilities and local government in a coordinated campaign attributed to MuddyWater. ESET tracked the activity to Iran-linked operators and observed overlaps with other Tehran-aligned groups.
The operation ran from 30 September 2024 to 18 March 2025, with one technology target in Egypt, underscoring regional exposure and the risk to supply chains.
The attackers used phishing PDFs, VPN exploits and remote administration tools to deliver a stealthy Windows backdoor that prioritises credential theft and data exfiltration.
MuddyViper backdoor attacks: What You Need to Know
- MuddyViper backdoor attacks combine phishing, VPN weaknesses and living-off-the-land tools to deliver covert access, steal credentials and sustain persistence across Israeli networks.
Recommended security tools to counter campaigns like MuddyViper:
- Bitdefender – layered endpoint protection against malware and advanced threats.
- 1Password – strong password management to limit credential abuse.
- IDrive – secure backups to accelerate recovery and reduce downtime.
- Tenable – continuous vulnerability assessment for exposed VPNs and edge devices.
Attribution, targets and timeline
ESET links the latest MuddyViper backdoor attacks to MuddyWater, also known as Mango Sandstorm, Static Kitten and TA450, an operation associated with Iran’s Ministry of Intelligence and Security.
The campaign primarily targeted Israeli entities in academia, engineering, local government, manufacturing, technology, transportation and utilities, with a single technology firm in Egypt also affected.
MuddyWater has operated for years, previously deploying POWERSTATS in 2017 and using PowGoop for disruptive activity in Operation Quicksand.
Israel’s National Cyber Directorate has tied the group’s historical targeting to local authorities, civil aviation, tourism, healthcare, telecoms, IT and SMEs, showing how Israeli critical infrastructure attacks regularly extend into commercial ecosystems.
The group’s tactics remained consistent: spear-phishing, exploitation of known VPN flaws and the deployment of legitimate remote tools for command and control.
Organisations should revisit email controls and user awareness; see guidance on how to avoid phishing attacks. They should also harden edge appliances, given the current focus on exploited VPN vulnerabilities.
For a broader defensive context, review our coverage of phishing-led credential compromise and credential exposure mitigation.
Tactics, techniques and loaders
Many MuddyViper backdoor attacks begin with phishing emails bearing PDFs that direct victims to install legitimate remote desktop tools such as Atera, Level, PDQ or SimpleHelp. A loader dubbed Fooder then decrypts and executes the C/C++ MuddyViper backdoor, establishing persistence and covert control.
In some intrusions, a C/C++ loader installs go-socks5 reverse-tunnelling proxies and the open-source HackBrowserData utility to harvest credentials and browser artefacts across Chromium and Gecko-based browsers.
Fooder variants sometimes masquerade as the Snake game and delay execution to evade detection, a technique publicly noted in 2025.
From Fooder to credential theft
The backdoor supports 20 commands, enabling system reconnaissance, file execution, shell command invocation, file transfer and exfiltration of Windows credentials and browser data. MuddyViper backdoor attacks often layer additional components, including:
- VAXOne, a backdoor that impersonates Veeam, AnyDesk, Xerox and OneDrive updater services
- CE-Notes, a stealer that attempts to bypass Chrome’s app-bound encryption by extracting the Local State key, similar to ChromElevator
- Blub, a C/C++ browser-data stealer targeting Chrome, Edge, Firefox and Opera
- LP-Notes, a credential stealer that displays a fake Windows Security prompt
ESET also references earlier MuddyWater tooling such as BugSleep (aka MuddyRot), a phishing-delivered backdoor active since at least May 2024. For lineage and TTP evolution, see the analysis of the BugSleep malware implant in MuddyWater campaigns.
Operational overlaps with Lyceum/OilRig
ESET observed operational overlaps between MuddyWater and Lyceum, a subgroup of OilRig/APT34.
During January–February 2025, MuddyWater likely acted as an initial access broker inside an Israeli manufacturing organisation, deploying remote desktop tools and a custom Mimikatz loader. Stolen credentials were then likely leveraged by Lyceum for deeper access.
This shows how MuddyViper backdoor attacks can facilitate multi-actor operations within a single environment. For parallels in adversary tradecraft, see our report on Sliver C2 framework abuse.
Broader Iranian operations and recent leaks
In parallel, Israel’s National Digital Agency linked APT42, which overlaps with APT35/Charming Kitten, to an espionage campaign dubbed SpearSpecter.
A large leak posted by an anonymous “KittenBusters” collective in late 2025 exposed internal documents and source code associated with APT35 activity, including the BellaCiao backdoor.
Independent researchers described a structured, bureaucratic apparatus underpinning state-aligned cyber operations.
Implications for defenders and operators
Advantages
Public reporting on MuddyViper backdoor attacks provides concrete indicators, behaviours and toolmarks for detection, helping defenders tune EDR rules, enhance logging and strengthen phishing programmes.
It also clarifies how MuddyWater Iranian hackers blend legitimate remote tools, loaders like Fooder and data theft to maintain access.
Disadvantages
The same modular design and use of benign tools make MuddyViper backdoor attacks difficult to spot. Realistic lures, VPN exploitation and credential theft increase impact and recovery costs.
For critical sectors, risks include service disruption, extensive data loss and long-lived persistence that supports follow-on intrusions and wider Israeli critical infrastructure attacks.
Harden your stack against MuddyViper-like activity:
Conclusion
MuddyViper backdoor attacks signal a disciplined evolution in MuddyWater tradecraft, emphasising stealthy loaders, realistic tool impersonation and aggressive credential access to secure persistent footholds.
The campaign’s scope, including an Egyptian technology firm, shows how initial access can traverse borders and industries, amplifying operational risk across interconnected suppliers and services.
Defenders should prioritise phishing resilience, rigorous VPN patching and behavioural detection to limit the impact of MuddyViper backdoor attacks and related operations by MuddyWater Iranian hackers.
Questions Worth Answering
Who is behind MuddyViper?
ESET attributes MuddyViper backdoor attacks to MuddyWater, also known as Mango Sandstorm, Static Kitten and TA450, linked to Iran’s MOIS.
How is MuddyViper delivered?
Through spear-phishing PDFs that lead to remote tools, followed by the Fooder loader to decrypt and run the Windows backdoor.
What are MuddyViper’s capabilities?
It executes commands and files, exfiltrates Windows credentials and browser data, moves files and maintains covert control with 20 supported commands.
Which sectors were targeted?
Academia, engineering, local government, manufacturing, technology, transportation and utilities in Israel, plus one technology firm in Egypt.
How does it evade detection?
By abusing legitimate remote tools, delaying execution, impersonating trusted updaters and using modular loaders to blend into routine activity.
What should organisations do now?
Harden VPNs, tighten phishing defences, monitor remote tool usage and audit credentials to reduce the blast radius of MuddyViper backdoor attacks.
About ESET
ESET is a global cybersecurity vendor providing endpoint protection and threat intelligence to enterprises and consumers. Its research arm tracks APTs and malware ecosystems worldwide.
The company routinely publishes technical analyses, indicators of compromise and detection guidance that support incident response.
ESET’s reporting on MuddyViper details tools, techniques and procedures, enabling proactive detection and mitigation by security teams.
About Nariman Gharib
Nariman Gharib is a British–Iranian activist focused on transparency and digital rights related to Iran’s online operations and information control.
He has surfaced leaks and research tied to Iranian cyber activities, offering context on threat-actor structures and methods.
Gharib’s commentary on recent APT disclosures sheds light on the bureaucracy and tooling behind regional cyber-espionage campaigns.
Further reading and practical guidance
For pragmatic steps and background relevant to this campaign, see guidance on phishing risk reduction, analysis of MuddyWater’s BugSleep implant, and insight into risk from exploited VPN vulnerabilities.
