'MuddyWater' Hackers Target Israeli Orgs With Retro Game Tactic

MuddyWater (TA450), an Iran-linked APT, conducted a campaign from Sept. 30 to Mar. 18 targeting 18 organizations in Israel and one in Egypt, deploying a new Snake-inspired loader called Fooder that delays execution to evade sandboxes and reflectively loads the MuddyViper backdoor and stealer payloads; attackers used spear-phishing with PDF lures linking to RMM tools, leveraged Windows CNG for C2 communications, and demonstrated increased operational maturity and stealth despite operational clumsiness.