Iranian Hackers Deploy New BugSleep Backdoor in Middle East Cyber Attacks

MuddyWater (TA450), an Iran-linked nation-state actor, has shifted from abusing legitimate RMM tools to deploying a new bespoke x64 backdoor called BugSleep (aka MuddyRot) in recent spear-phishing campaigns. The implant, observed by Check Point and Sekoia, provides file upload/download, reverse shell, and persistence and communicates with a C2 over raw TCP on port 443; attacks use compromised business email accounts and Egnyte-hosted links/PDFs to deliver payloads, affecting countries across the Middle East and beyond.