Iran's 'MuddyWater' Levels Up With MuddyViper Backdoor

MuddyWater (TA450) conducted a stealthier, more sophisticated cyber-espionage campaign from late September 2024 to mid-March 2025 targeting mainly Israeli organizations (with at least one Egyptian victim). The operation used a new in-memory 64-bit loader called "Fooder," a custom backdoor "MuddyViper," and multiple credential stealers (CE-Notes, LP-Notes, Blub) to harvest credentials, exfiltrate data via reverse tunnels, and maintain persistence, with evidence of improved development capabilities and possible collaboration with Lyceum/OilRig.