MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools - TrendLabs Security Intelligence Blog

Trend Micro analyzed MuddyWater activity in H1 2019 and found renewed campaigns using spear-phishing with malicious documents to deliver a multi-stage PowerShell backdoor (POWERSTATS v3) and secondary payloads; the report describes obfuscation techniques, C2 behavior, GUID-based victim identification, use of CVE-2017-11882 template injection, and a range of open-source post-exploitation tools (e.g., Mimikatz, Empire, LaZagne) used by the actors.