MuddyWater__2020__Reviving_MuddyC3_Used_by_MuddyWater_IRAN_APT.pdf

This article analyzes a leaked MuddyC3 C2 and PowerShell agent used by the MuddyWater APT, documents how the C2 serves payloads, the agent registration/command/result endpoints, and demonstrates post-exploitation actions (credential dumping with Mimikatz and domain escalation). It also describes the leak/sale of MuddyWater tools by a group called GreenLeakers and includes IPs, payload examples, and notes about AV detection and planned encryption improvements.