ESET_MuddyWater_Dec2025

Fooder has stored its embedded payload in encrypted form within the binary, using a hardcoded key modified at runtime to produce the AES decryption key.

LP-Notes has dynamically resolved API functions during the C runtime startup.

LP-Notes has used a custom addition-based function and a string stacking function for string encryption.

Fooder has frequently masqueraded as the Snake game, using strings such as “Welcome to snake Game” and mutexes such as “SNAKE_G.”

MuddyViper has uploaded files to the C2 server. Additionally, MuddyViper has the ability to upload the specified file in chunks with sleep time between each chunk.

MuddyViper has the ability to establish persistence by creating a scheduled task named ManageOnDriveUpdater to launch itself during system startup.

LP-Notes has displayed a fake Windows Security dialog box to prompt for Windows credentials.

MuddyViper has displayed a fake Windows Security dialog to gather credentials.

LP-Notes has searched for the process taskhostw.exe.

MuddyViper has the ability to collect running processes.

MuddyViper has launched a reverse shell using a provided command line.

LP-Notes has been downloaded and executed by PowerShell’s`Invoke-WebRequest` and `Invoke-Expression` cmdlets.

MuddyViper has used PowerShell.exe to launch a reverse shell.

MuddyViper has used cmd.exe to launch a reverse shell.

MuddyViper has used HTTP GET requests over port 443 and with the WINHTTP_FLAG_SECURE set to SSL/TLS via the WinHTTP API.

LP-Notes has stored collected credentials in ` C:\Users\Public\Downloads\lp-notes.txt`.

LP-Notes has used stolen Windows credentials to log in as the users.

MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2). MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT), to communicate with a hardcoded C2 server, and to exfiltrate data.

MuddyViper has the ability to download files from the C2 server. Additionally, MuddyViper has the ability to download a file in chunks with sleep time between each chunk.

LP-Notes has used the `ImpersonateLoggedOnUser` API to impersonate the security context of the taskhostw.exe process. Additionally, LP-Notes has also used the `CredUIPromptForWindowsCredentialsW` API to obtain Windows credentials.

Fooder has used the WinCrypt API for payload decryption, `DuplicateTokenEx` to duplicate the token of a specified process, and `CreateProcessAsUserA` for payload execution.

MuddyViper has the ability to relaunch itself using the `CreateProcessW` API.

MuddyViper has the ability to clear the Registry values in the Windows Startup folder that were previously set for persistence.

Fooder has used the `DuplicateTokenEx` API to duplicate the token of a specified process, and `CreateProcessAsUserA` to execute its payload.

LP-Notes has impersonated the security context of the taskhostw.exe process via the `ImpersonateLoggedOnUser` API.

LP-Notes has decrypted strings with lengths ranging from 15 to 19 characters using the same decryption key for each string.

MuddyViper has decrypted the embedded HackBrowserData tool prior to execution.

Fooder has decrypted payloads using the WinCrypt API and the AES key.

MuddyViper has the ability to check for a specified list of security tools in the compromised environment.

MuddyViper has the ability to establish persistence by configuring its installation directory as a Windows Startup folder by setting the following Registry values to `%APPDATALOCAL%\Microsoft\Windows\PPBCompatCache\ManagerCache`:  `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup`.

MuddyViper has archived collected web browser data into a file named CacheDump.zip.

LP-Notes has encrypted collected credentials using AES-CBC from the CNG API and the key ED15C8344B45DAED1E0578F8BC1A32411812C61F4CB45D89B107287DE0E09FFC
and the initialization vector 91A4E6F6D51DAEE773A8F00279792578.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.

MuddyViper has the ability to encrypt C2 communication using AES-CBC using the CNG API, the key `0608101047106453101617106423101013101012101083109710108585106969`, and the initialization vector `0`.

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.

Fooder has reflectively loaded a payload into memory.

MuddyViper has reflectively loaded the decrypted HackBrowserData tool in a new thread.

Fooder has used a custom delay function (`delayExecution(integer)`) and Sleep API calls (`Sleep(integer)`) to slow code execution.

MuddyViper has the ability to sleep for a certain amount of time, with the default being one minute.