One of the most active state-affiliated cyberespionage groups, Boggy Serpens — also known as MuddyWater — appears to have significantly upped the ante in its attacks. The group, which is affiliated with Iran’s Ministry of Intelligence and Security (MOIS), is ramping up its targeted operations against critical sectors such as diplomacy, energy, shipping, and financial services . Although it has been active since at least 2017, its recent campaigns reveal a clear shift toward more sophisticated and strategically designed attacks.
From mass attacks to targeted and persistent intrusion
In its early years, MuddyWater relied primarily on mass spear phishing attacks, emphasizing speed and scale over stealth. It used widely available remote administration tools, such as Atera and ScreenConnect, to gain access to systems.
See also: CRIL: Growing threat of cyberattacks in the Middle East
However, according to analysts at Unit 42, the group has now shifted to a more patient model, emphasizing long-term persistence within systems and exploiting trust relationships between organizations. This shift makes attacks harder to detect and more dangerous over time.
New tools and use of artificial intelligence
One of the most worrying elements of the new phase is the development of custom malware in the Rust, which offers increased memory security and significantly complicates analysis by experts. At the same time, the group is reportedly leveraging techniques Generative AI to produce new versions of the malware more quickly.
Collaboration with other groups, such as Evasive Serpens (Lyceum), also shows that there is coordination and shared resources within Iran’s broader cyber threat ecosystem. This enhances the overall operational capability and sophistication of attacks.
Global reach and high‑value targets
The group's activity spans multiple geographic regions, including countries in the Middle East, Europe, and South America . Government agencies, airlines, shipping companies, and energy giants are targeted
See also: FBI steps up crackdown on fraud centers targeting Americans
Of particular interest is a months-long attack on a UAE-based energy and shipping company linked to Saudi Aramco. This operation, which lasted from August 2025 to February 2026, highlights the group’s persistence and strategic planning.
Dual deception model and social engineering
One of MuddyWater's key weapons is the use of a two-pronged social engineering mechanism. In the first stage, attackers exploit accounts email from trusted organizations, sending messages that bypass spam filters due to their "internal" origin.
In the second stage, victims are invited to open attachments that appear perfectly legitimate, such as financial reports or even airline tickets. These documents display messages requesting macro activation, leading to the execution of malicious code without the user realizing the threat.
Advanced backdoors and evasion techniques
Forensic analysis revealed the existence of multiple malware families, such as BugSleep and Nuso HTTP, as well as lighter UDP-based backdoors. These tools share common characteristics, suggesting unified development and coordination.
The use of such techniques allows attackers to maintain access to systems for a long time, without being easily detected by traditional security systems.
See also: Phishing: Man targeted NBA, NFL athletes while in federal prison
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Defense against advanced threats
Countering such attacks requires a multi-layered approach. Organizations are urged to implement strict policies on Microsoft Office macros, enable multi-factor authentication on all email accounts, and invest in behavioral anomaly detection.
At the same time, continuous monitoring for suspicious activity, such as unusual UDP connections or unexpected system changes, can prove critical for early detection. In an environment where state-sponsored attacks are becoming increasingly sophisticated, prevention and early response are the primary line of defense.
