{"id":9053,"date":"2025-12-02T12:00:00","date_gmt":"2025-12-02T10:00:00","guid":{"rendered":"https:\/\/blog.eset.ee\/et\/?p=9053"},"modified":"2026-06-14T20:08:18","modified_gmt":"2026-06-14T17:08:18","slug":"muddywater-snakes-by-the-riverbank","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2025\/12\/02\/muddywater-snakes-by-the-riverbank\/","title":{"rendered":"MuddyWater: Snakes by the riverbank"},"content":{"rendered":"

ESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its persistent targeting of government and critical infrastructure sectors, often leveraging custom malware and publicly available tools. In this campaign, the attackers deployed a set of previously undocumented, custom tools with the objective of improving defense evasion and persistence. Among these tools is a custom Fooder loader designed to execute MuddyViper, a C\/C++ backdoor. Several versions of Fooder masquerade as the classic Snake game, and its internal logic includes a custom delay function inspired by the game\u2019s mechanics, combined with frequent use of Sleep<\/span> API calls. These features are intended to delay execution and hinder automated analysis. MuddyViper enables the attackers to collect system information, execute files and shell commands, transfer files, and exfiltrate Windows login credentials and browser data. The campaign also leverages credential stealers (CE\u2011Notes and LP\u2011Notes) and reverse tunneling tools (go\u2011socks5), long a favorite of MuddyWater operators.<\/p>\n

Although this is our first public blogpost covering MuddyWater, ESET researchers have been tracking the group for several years and have documented its activities in multiple ESET<\/a>
\nAPT<\/a>
\nActivity<\/a>
\nReports<\/a>. Unlike previous campaigns of MuddyWater, which were often noisy and easily detected, the one covered in this blogpost demonstrates a more focused, sophisticated, and refined approach.<\/p>\n

\n
Key points of this blogpost:<\/strong><\/div>\n