MuddyWater__2022__Cisco_Iranian-MuddyWater-regionally-focused-subgroups_03-10-2022.pdf

Cisco Talos reports that the Iran-linked APT MuddyWater operates as a conglomerate of regionally focused subgroups conducting persistent campaigns across Turkey, the Arabian Peninsula, Pakistan, Armenia and other regions; they deliver maldocs that drop script-based RATs (notably a WSF RAT named SloughRAT), VBS/JS/PowerShell downloaders, and leverage tools like Ligolo for reverse tunneling, with detailed technical analysis and IOCs provided to detect and mitigate these threats.