Business logic of attack: why emulate MuddyWater APT
MuddyWater (Boggy Serpens, Mango Sandstorm, TA450) - a group under the authority of the Ministry of Intelligence and Security of Iran (MOIS), active since 2017 (MITRE ATT&CK G0069) Goals - state institutions, telecom, energy, defense, oil and gas in the Middle East, Asia, Africa and Europe. According to Unit 42, at the beginning of 2025, the operational intersections of MuddyWater with the group Lyceum (Evasive Serpens) were recorded - coordination of resources within the Iranian intelligence community
The final goal is not destruction and no extortion. MuddyWater is engaged in cyber espionage: excretory of correspondence, documents, network mapping. According to MITRE ATT&CK, the collected data is transmitted to other Iranian threat ACTs for further operations.
Why is it for the Red Team operator: if the customer works in the energy sector, ICS-segment, marine logistics or public sector - MuddyWater is included in the list of realistic threats. Emulation of their TTPs on engagement checks whether the Blue Team will detect a specific chain - from a macro document to C2 via Telegram. This is an adversary simulation with a link to a live group, not an abstract scanner run.
Operationalampo: MuddyWater campaign analysis
Discallimmer: All the details of the campaign - payload names (CHAR, GhostFetch, HTTP_VIP, GhostBackDoor), drop-paths, C2 domains - are based on Group-IB and Unit 42 reports. Direct references to the original sources in the article are not given; data require independent verification.
According to Group-IB, Operation Olalampo was aimed at organizing and individuals in the MENA region. The campaign coincided with the escalation of geopolitical tensions in the Middle East.
Unit 42 (Palo Alto Networks) described several waves of attacks on the same energy and seafry company in the Middle East (according to available publications, requires verification on the source). Each wave adapted baits for specific departments - from project engineers to financiers. This level of persistence points to a purposeful mandate to penetrate the infrastructure of marine logistics.
Kill chain: spear phishing from a compromised box -> Office-document with VBA-macros -> decode payload from the hidden UI element -> to drop disc -> ->llest C2.
Phishing documents: three options for target phishing Office
Group-IB identifies three versions of documents, each with its own theme and final payload:
Option 1 - Excel, accounting tables. It mimics the financial statements of the energy and marine company, focused on engineers and contractors. The final payload - CHAR (according to Group-IB), backdoor on Rust with C2 via Telegram Bot API. Drop path: C:\Users\Public\Downloads\novaservice.exe.
Option 2 - Excel, the same theme. A similar bait, but delivers GhostFetch (according to Group-IB) is a bootloader of the first stage, pulling up GhostBackDoor. Drop path: C:\Users\Public\Documents\MicrosoftExcelUser.exe.
Option 3 - Word/Excel, air tickets and reports (Group-IB describes a macro as Workbook_Open, characteristic of Excel, with the theme of the Word-document - an interesting inconsistency). According to Unit 42, one of the documents contained a personalized reservation of Air Arabia - the name of the passenger, the route, category "Corporate Fare". The level of detail indicates the use of data from previous compromise. It delivers HTTP_VIP (according to Group-IB) - a downloader that installs AnyDesk (legitimate RMM). Drop path: C:\Users\Public\Documents\MicrosoftWordUser.exe.
OPSEC-remark: delivery of the ticket as .docx instead of PDF - operating anomaly. Unit 42 notes that high-quality social engineering is being undermined by the technical delivery format. On engagement, it is worth considering: too specific bait will attract the attention of the SOC-analyst faster than the payload will work.
VBA macros: malicious code in detail
All three options use one logic with minimal differences in implementation. Key elements, according to Group-IB:
Workbook_Open() - point of entry. Macros starts automatically when you open a document on Windows with Microsoft Office, if macros are allowed. The Malicious File Technique (T1204.002, Execution)
Wait() - sandbox evasion. Instead of WinAPI-call-call Sleep() A set cycle is used. Sandboxes intercept Sleep/NtDelayExecution to speed up the analysis - this loop is bypassing this loop because the API does not turn to at all.
Payload in the hidden UserForm. Decimal-encoded line is stored in UserForm1.TextBox1.Text - an element of form, invisible to the user. Macros reads the string, decodes and records the PE-file to the disk. Visual Basic (T1059.005, Execution) in conjunction with Command Obfuscation (T1027.010, Defense Evasion)
Code:
Private Sub Workbook_Open()
Call wait ' anti-sandbox: nested loop
Load UserForm1 '
Dim enc As String
enc = UserForm1.TextBox1.Text ' decimal-encoded payload
Dim parts() As String
parts = Split(enc, ",") '
' decode bytes → write C:\Users\Public\Downloads\ -> execute
End Sub
Keeping payload in UserForm instead of an open VBA code makes it difficult for static analysis – standard YARA rules are looking for suspicious functions (Shell, CreateObject) rather than data in the form elements. Caught.
MuddyWater (Boggy Serpens, Mango Sandstorm, TA450) - a group under the authority of the Ministry of Intelligence and Security of Iran (MOIS), active since 2017 (MITRE ATT&CK G0069) Goals - state institutions, telecom, energy, defense, oil and gas in the Middle East, Asia, Africa and Europe. According to Unit 42, at the beginning of 2025, the operational intersections of MuddyWater with the group Lyceum (Evasive Serpens) were recorded - coordination of resources within the Iranian intelligence community
The final goal is not destruction and no extortion. MuddyWater is engaged in cyber espionage: excretory of correspondence, documents, network mapping. According to MITRE ATT&CK, the collected data is transmitted to other Iranian threat ACTs for further operations.
Why is it for the Red Team operator: if the customer works in the energy sector, ICS-segment, marine logistics or public sector - MuddyWater is included in the list of realistic threats. Emulation of their TTPs on engagement checks whether the Blue Team will detect a specific chain - from a macro document to C2 via Telegram. This is an adversary simulation with a link to a live group, not an abstract scanner run.
Operationalampo: MuddyWater campaign analysis
Discallimmer: All the details of the campaign - payload names (CHAR, GhostFetch, HTTP_VIP, GhostBackDoor), drop-paths, C2 domains - are based on Group-IB and Unit 42 reports. Direct references to the original sources in the article are not given; data require independent verification.
According to Group-IB, Operation Olalampo was aimed at organizing and individuals in the MENA region. The campaign coincided with the escalation of geopolitical tensions in the Middle East.
Unit 42 (Palo Alto Networks) described several waves of attacks on the same energy and seafry company in the Middle East (according to available publications, requires verification on the source). Each wave adapted baits for specific departments - from project engineers to financiers. This level of persistence points to a purposeful mandate to penetrate the infrastructure of marine logistics.
Kill chain: spear phishing from a compromised box -> Office-document with VBA-macros -> decode payload from the hidden UI element -> to drop disc -> ->llest C2.
Phishing documents: three options for target phishing Office
Group-IB identifies three versions of documents, each with its own theme and final payload:
Option 1 - Excel, accounting tables. It mimics the financial statements of the energy and marine company, focused on engineers and contractors. The final payload - CHAR (according to Group-IB), backdoor on Rust with C2 via Telegram Bot API. Drop path: C:\Users\Public\Downloads\novaservice.exe.
Option 2 - Excel, the same theme. A similar bait, but delivers GhostFetch (according to Group-IB) is a bootloader of the first stage, pulling up GhostBackDoor. Drop path: C:\Users\Public\Documents\MicrosoftExcelUser.exe.
Option 3 - Word/Excel, air tickets and reports (Group-IB describes a macro as Workbook_Open, characteristic of Excel, with the theme of the Word-document - an interesting inconsistency). According to Unit 42, one of the documents contained a personalized reservation of Air Arabia - the name of the passenger, the route, category "Corporate Fare". The level of detail indicates the use of data from previous compromise. It delivers HTTP_VIP (according to Group-IB) - a downloader that installs AnyDesk (legitimate RMM). Drop path: C:\Users\Public\Documents\MicrosoftWordUser.exe.
OPSEC-remark: delivery of the ticket as .docx instead of PDF - operating anomaly. Unit 42 notes that high-quality social engineering is being undermined by the technical delivery format. On engagement, it is worth considering: too specific bait will attract the attention of the SOC-analyst faster than the payload will work.
VBA macros: malicious code in detail
All three options use one logic with minimal differences in implementation. Key elements, according to Group-IB:
Workbook_Open() - point of entry. Macros starts automatically when you open a document on Windows with Microsoft Office, if macros are allowed. The Malicious File Technique (T1204.002, Execution)
Wait() - sandbox evasion. Instead of WinAPI-call-call Sleep() A set cycle is used. Sandboxes intercept Sleep/NtDelayExecution to speed up the analysis - this loop is bypassing this loop because the API does not turn to at all.
Payload in the hidden UserForm. Decimal-encoded line is stored in UserForm1.TextBox1.Text - an element of form, invisible to the user. Macros reads the string, decodes and records the PE-file to the disk. Visual Basic (T1059.005, Execution) in conjunction with Command Obfuscation (T1027.010, Defense Evasion)
Code:
Private Sub Workbook_Open()
Call wait ' anti-sandbox: nested loop
Load UserForm1 '
Dim enc As String
enc = UserForm1.TextBox1.Text ' decimal-encoded payload
Dim parts() As String
parts = Split(enc, ",") '
' decode bytes → write C:\Users\Public\Downloads\ -> execute
End Sub
Keeping payload in UserForm instead of an open VBA code makes it difficult for static analysis – standard YARA rules are looking for suspicious functions (Shell, CreateObject) rather than data in the form elements. Caught.
