MuddyWater__2019__The_Muddy_Waters_of_APT_Attacks.pdf

This Check Point report analyzes a MuddyWater APT campaign that uses spear-phishing Word documents with malicious macros to drop Delphi/UPX executables (CiscoAny.exe), create INF-based persistence, and deploy a second-stage uploader that posts system details to a hardcoded C2 (185.117.75.116) and retrieves PowerShell payloads (commonly POWERSTATS). The report documents the full infection flow, anti-analysis techniques, VBA/macro similarities across multiple samples, sample SHA‑256 hashes, domains/IPs used for C2, and defensive detection recommendations.