MuddyWater Launches MuddyViper Backdoor Against Israeli Critical Infrastructure

Scworld

MuddyWater Launches MuddyViper Backdoor Against Israeli Critical Infrastructure

First seen 3 Dec 2025, 22:41 UTC • •48.1

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

MuddyWater, an Iran-linked threat actor, has initiated a campaign targeting critical infrastructure in Israel and one Egyptian entity, deploying a new backdoor named MuddyViper. The operation, which took place from September 30, 2024, to March 18, 2025, affected sectors such as technology, engineering, manufacturing, local government, and education.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 241d ago How this analysis works

More articles in this cluster (2)

Threat Graph

8 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

MuddyWater
OilRig

Technique (2)

Malware
T1059.001 - PowerShell

Malware (1)

MuddyViper

Affected Platform (1)

Windows

Tool (2)

Fooder
PowerShell

Relationships

MuddyWater uses MuddyViper
OilRig uses MuddyViper
MuddyWater uses Fooder
MuddyWater uses PowerShell
OilRig uses Fooder
OilRig uses PowerShell
MuddyWater uses Malware
MuddyWater uses T1059.001 - PowerShell
OilRig uses Malware
OilRig uses T1059.001 - PowerShell
MuddyWater related to Windows

Following this threat?

Track MuddyWater and MuddyViper in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that…

Iranian Espionage Campaign UNK_SmudgedSerpent Targets Academics Proofpoint has identified an Iranian-linked espionage group named UNK_SmudgedSerpent, which has been active since mid-2025. This group targets academics and foreign policy experts, utilizing highly targeted phishing techniques and credential theft operations. The campaign began with benign emails discussing Iran's…