MuddyWater Launches MuddyViper Backdoor Against Israeli Critical Infrastructure

Scworld

MuddyWater Launches MuddyViper Backdoor Against Israeli Critical Infrastructure

First seen 3 Dec 2025, 22:41 UTC • •48.1

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

MuddyWater, an Iran-linked threat actor, has initiated a campaign targeting critical infrastructure in Israel and one Egyptian entity, deploying a new backdoor named MuddyViper. The operation, which took place from September 30, 2024, to March 18, 2025, affected sectors such as technology, engineering, manufacturing, local government, and education.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 196d ago How this analysis works

More articles in this cluster (2)

Threat Graph

8 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

MuddyWater
OilRig

Technique (2)

Malware
T1059.001 - PowerShell

Malware (1)

MuddyViper

Affected Platform (1)

Windows

Tool (2)

Fooder
PowerShell

Relationships

MuddyWater uses MuddyViper
OilRig uses MuddyViper
MuddyWater uses Fooder
MuddyWater uses PowerShell
OilRig uses Fooder
OilRig uses PowerShell
MuddyWater uses Malware
MuddyWater uses T1059.001 - PowerShell
OilRig uses Malware
OilRig uses T1059.001 - PowerShell
MuddyWater related to Windows

Following this threat?

Track MuddyWater and MuddyViper in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Spring Ring: Coordinated Vishing Campaign Exploits Microsoft Teams Between January and April 2026, a coordinated voice phishing campaign named Spring Ring targeted over 150 employees across more than 10 companies using fake IT support accounts on Microsoft Teams. Attackers registered external Teams tenants with names resembling internal IT departments to gain trust. The campaign…

Iran's Ravin Academy Launches Largest Cyber Training Class Amid US-Iran Tensions Ravin Academy, an Iranian cybersecurity training firm, has announced its largest recruitment drive, seeking between 600 and 1,200 young Iranians for a free yearlong cybersecurity scholarship. This initiative occurs amid escalating cyberattacks attributed to Iran against US infrastructure. The US Treasury previously…