Iranian Cyber-Threat Group Drops New Backdoor, 'BugSleep'

Iran-linked APT MuddyWater has transitioned from using legitimate remote-management software to delivering a custom backdoor called MuddyRot (also reported as BugSleep) via malicious PDFs hosted on file-sharing services such as Egnyte. The report highlights the implant's anti-analysis techniques, encryption and implementation bugs indicative of active development, and ongoing targeted phishing campaigns against government and critical-sector organizations across multiple countries in the Middle East and beyond.