Muddyc2go

MuddyC2Go is a new malware that has been linked to the Iranian state-backed threat operation MuddyWater. The first evidence of malicious activity was identified through the execution of PowerShell code, which connected to a command-and-control (C2) framework known as MuddyC2Go. This infrastructure is associated with Seedworm, an advanced persistent threat group. MuddyC2Go, a successor to MuddyC3 and PhonyC2, showcases Iran's rapidly improving malicious cyber capabilities. Its deployment marks a significant shift in strategy following the exposure of the source code of its predecessor, PhonyC2. The utilization of MuddyC2Go was first seen in attacks against Israel in November 2023. These attacks were part of a broader pattern of MuddyWater activities aimed at disrupting operations and stealing valuable information. In addition to Israel, the telecommunications sector in Egypt, Sudan, and Tanzania has also been targeted using this novel C2 framework. The malware is delivered via a PowerShell launcher, and once inside a system, it establishes contact with an actor-controlled server, thereby granting remote access to the attackers. While the full extent of MuddyC2Go’s capabilities remains unknown, several tools have been identified that facilitate these attacks. These include the SimpleHelp remote management software for continuous access to compromised devices and command execution, and the Venom Proxy software for managing intranet-connected devices. The revelation of MuddyC2Go's use underscores the evolving threat landscape and the need for constant vigilance and robust cybersecurity measures.