Iran’s MuddyWater APT targets Saudis and Israelis with BugSleep Backdoor

Check Point and reporting sites uncovered a MuddyWater phishing campaign that deployed a custom backdoor called BugSleep against targets in Saudi Arabia and Israel. The report describes delivery via phishing lures and Egnyte file-sharing, sandbox-evasion using repeated Windows Sleep API calls, remote command and file-transfer capabilities to attacker-controlled C2, and evidence of iterative updates and targeted regional infrastructure.