Iranian Hackers Using MuddyC2Go in Telecom Espionage Attacks Across Africa

Executive summary: Symantec/Broadcom observes the Iranian APT MuddyWater (Seedworm) deploying a newly identified Golang C2 framework (MuddyC2Go) in November 2023 attacks against telecommunications organizations in Egypt, Sudan, and Tanzania; intrusions combined bespoke malware (custom keylogger, MuddyC2Go), living‑off‑the‑land techniques (PowerShell), and legitimate remote‑access tools (SimpleHelp, AnyDesk, JumpCloud) to maintain persistence and evade detection.