SimpleHarm: Tracking MuddyWater’s infrastructure

Group-IB documents MuddyWater (an Iran-linked APT) leveraging legitimate remote-administration tools (SimpleHelp, ScreenConnect, RemoteUtilities, Syncro) and custom Cobalt Strike components to maintain persistence and conduct espionage across multiple countries; the report maps extensive infrastructure (ETag hashes, SSH fingerprints, dozens of IP addresses), provides hashes and example artifacts (PowerShell script, shortcut download commands, signed SimpleHelp binary), and offers actionable IOCs and hunting/mitigation guidance for defenders.