Iranian hackers targeted over 100 govt orgs with Phoenix backdoor

Group-IB reports that Iranian-linked APT MuddyWater conducted a phishing campaign beginning August 19 that targeted over 100 government and diplomatic organizations in the Middle East and North Africa, delivering malicious Word documents with macros that installed a FakeUpdate loader which decrypted and deployed Phoenix backdoor v4 (written to C:\ProgramData\sysprocupdate.exe) and a Chrome-family infostealer; the campaign used WinHTTP C2 communications, COM-based persistence, and additional tooling (PDQ, Action1), and Group-IB attributes the activity to MuddyWater with high confidence.