Inside a MuddyWater Intrusion: Exploitation of SharePoint and Living-Off-the-Land Tactics

In late August 2025 an IR team investigated a targeted MuddyWater (Static Kitten) intrusion that exploited SharePoint CVE-2025-53770 to deploy file-management webshells and attempt to load a PowerShell RAT; the adversary escalated privileges with GodPotato, dumped LSASS, moved laterally using Invoke-SMBExec and WMI, abused AnyDesk and PDQ for persistence, deployed a custom TLS-resocks tunnel (FMAPP.exe / FMAPP.dll) for pivoting, and exfiltrated archived credential artifacts via the SharePoint server; the report contains technical analysis, IOCs (IPs, SHA256, domains), and MITRE ATT&CK mappings.