OTX BotFeb 23

Chronology of MuddyWater APT Attacks Targeting the Middle East

This report analyzes the recent activities of the MuddyWater APT group, which primarily targets organizations in the Middle East. The group employs sophisticated spear-phishing techniques, often impersonating legitimate entities and using malicious documents to gain initial access. Their attacks focus on long-term infiltration and intelligence gathering rather than immediate disruption. The report details several attack cases from 2019 to 2026, highlighting the group's evolving tactics, including the abuse of legitimate remote management tools and the use of Rust-based malware. The analysis emphasizes the importance of endpoint detection and response (EDR) solutions in identifying and mitigating these threats, as traditional perimeter-based security measures prove insufficient against such advanced persistent threats.

Pulse ID: 699c1f410e4279a65c5a7b06
Pulse Link: https://otx.alienvault.com/pulse/699c1f410e4279a65c5a7b06
Pulse Author: AlienVault
Created: 2026-02-23 09:34:57

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EDR #Endpoint #EndpointDetectionandResponse #ICS #InfoSec #MaliciousDocument #Malware #MiddleEast #MuddyWater #OTX #OpenThreatExchange #Phishing #RAT #Rust #SpearPhishing #bot #AlienVault

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

LevelBlue Open Threat Exchange
ITSEC NewsApr 16, 2020
New PoetRAT Hits Energy Sector With Data-Stealing Tools - A never-before-seen RAT is targeting Azerbaijan energy companies with various tools aimed at steal... more: https://threatpost.com/new-poetrat-hits-energy-sector-with-data-stealing-tools/154876/ #remoteaccesstrojan #maliciousdocument #azerbaijanenergy #cybersecurity #coronavirus #malware #poetrat #scada #rat
New PoetRAT Hits Energy Sector With Data-Stealing Tools

A never-before-seen RAT is targeting Azerbaijan energy companies with various tools aimed at stealing credentials and exfiltrating valuable data.

Threatpost - English - Global - threatpost.com
ITSEC NewsJan 23, 2020
U.S. Gov Agency Targeted With Malware-Laced Emails - The malicious email campaign included a never-before-seen malware downloader called Carrotball, an... more: https://threatpost.com/u-s-gov-agency-malware-laced-emails/152141/ #maliciousdocument #fracturedstatue #u.s.government #spearphishing #government #carrotball #konnigroup #northkorea #carrotbat #phishing #security #malware #syscon #email #nokki #apt
U.S. Gov Agency Targeted With Malware-Laced Emails

The malicious email campaign included a never-before-seen malware downloader called Carrotball, and may be linked to the Konni Group APT.

Threatpost - English - Global - threatpost.com
ITSEC NewsSep 23, 2019
More U.S. Utility Firms Targeted in Evolving LookBack Spearphishing Campaign - A spearphishing campaign first uncovered in July is hitting more utilities firms and spreading the... more: https://threatpost.com/more-u-s-utility-firms-targeted-in-evolving-lookback-spearphishing-campaign/148575/ #maliciousdocument #vulnerabilities #lookbackmalware #maliciousemail #socialengineer #spearphishing #utilities #lookback #phishing #malware #macros #trojan #email
LookBack Malware Targets More Utilities Firms With New Macros, Tactics

A spearphishing campaign first uncovered in July is hitting more utilities firms and spreading the LookBack malware, which has capabilities to view system data and reboot machines.

Threatpost - English - Global - threatpost.com