MuddyWater Phishing Campaign Targets Global Organizations

Researchers at Group-IB have uncovered a new phishing campaign by the MuddyWater threat actor, targeting governmental and international organizations across multiple regions. The campaign uses the Phoenix backdoor v4, a new FakeUpdate injector, and a custom credential stealer disguised as a calculator. The attackers leverage compromised email accounts and legitimate VPN services to bypass detection and establish persistent access. The campaign begins with phishing emails from compromised accounts, leading to the deployment of malicious macros that execute the Phoenix backdoor. The backdoor registers the compromised host with a C2 server, allowing full control to the attacker. The campaign's targets include diplomatic, humanitarian, and energy-sector entities.