New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns - Check Point Research

This report documents increased MuddyWater (Iranian MOIS-linked) activity since late 2023, detailing phishing campaigns that deliver legitimate RMM tools and a new custom backdoor called BugSleep targeting organizations (notably in Israel and several Middle Eastern and other countries); it provides a technical analysis of BugSleep (persistence via scheduled tasks, process injection, custom encryption, evasion techniques), the typical Egnyte-based infection chain, observed bugs in samples, targeted sectors, and extensive IOCs and mitigations.