Iranian intel cyber suite of malware uses open source tools.pdf

U.S. Cyber Command reports that Iranian intelligence actors associated with MuddyWater (an element of MOIS) are using open-source tooling and malware — including PowGoop loaders and Mori Backdoor — to maintain access to victim networks globally; techniques observed include DLL side‑loading, PowerShell script obfuscation, modified base64 C2 communication, and DNS tunneling, and multiple samples and IOCs have been published to VirusTotal.