MuddyWater__2018__MuddyWater-Operations-in-Lebanon-and-Oman.pdf

**MuddyWater Operations in Lebanon and Oman:** ClearSky details a two-stage spear-phishing campaign by the MuddyWater APT that uses macro-embedded Word documents to spawn an Excel COM process which downloads obfuscated PowerShell hosted on compromised domains (including an Israeli domain) and executes a three-step chain (VBE → JavaScript → PowerShell) to install the POWERSTATS backdoor; the report includes technical deobfuscation, persistence findings (scheduled task / Run key), and IOCs for detection and mitigation.