MuddyWater__2019__MuddyC3.pdf

This Qianxin Threat Intelligence report analyzes the leaked MuddyC3 web-based C2 tool tied to the MuddyWater APT: researchers obtained source and samples (v1.0.0/1.0.1), decompiled PyInstaller-built Python code, mapped project structure and web endpoints, and documented macro-based initial payload delivery and C2 behavior; the leak and publicly posted samples (GitHub, Hybrid Analysis) indicate active tooling that supported spear-phishing campaigns against Middle Eastern targets.