Clearsky-Iranian-APT-group-‘MuddyWater’-Adds-Exploits-to-Their-Arsenal.pdf

ClearSky's June 2019 intelligence report analyzes an active MuddyWater campaign that leverages malicious Microsoft Office documents—both VBA macro-based and CVE-2017-0199 exploits—to deliver a PowerShell-extracted RAT and maintain C2 communications; the report provides behavioural analysis, observed infection chains, compromised servers, and a set of IoCs (hashes, IPs, and malicious URLs) targeting governmental and telecommunications entities in the region.