MuddyWater Deploys Fooder Loader and MuddyViper Backdoor in Refined Campaign Against Israeli Targets
ESET researchers have uncovered a new MuddyWater campaign targeting Israeli organizations and one Egyptian entity, deploying previously undocumented tools including the Fooder loader and MuddyViper backdoor.
ESET researchers have identified a new campaign by the Iran-aligned cyberespionage group MuddyWater (also known as Mango Sandstorm or TA450) primarily targeting organizations in Israel, with one confirmed victim in Egypt. The campaign marks a significant technical evolution for the group, which has historically relied on noisy, easily detected operations. This time, the attackers deployed a suite of previously undocumented custom tools designed to improve defense evasion and persistence, signaling a more focused and sophisticated approach.
At the heart of the campaign is the Fooder loader, a custom tool that masquerades as the classic Snake game to delay analysis and hinder automated detection. The loader's internal logic includes a custom delay function inspired by the game's mechanics, combined with frequent use of Sleep API calls. Fooder reflectively loads into memory and executes the MuddyViper backdoor, a C/C++ backdoor that enables attackers to collect system information, execute files and shell commands, transfer files, and exfiltrate Windows login credentials and browser data.
In addition to MuddyViper, the campaign leverages credential stealers dubbed CE-Notes and LP-Notes, as well as the Blub browser-data stealer and go-socks5 reverse tunneling tools—a long-standing favorite of MuddyWater operators. Notably, the operators deliberately avoided hands-on-keyboard interactive sessions, a historically noisy technique often characterized by mistyped commands. This shift reduces the likelihood of detection and demonstrates a more disciplined operational security posture.
A key technical highlight is MuddyWater's adoption of the Windows CNG (Cryptography Next Generation) API, a modern cryptographic interface. This is unique for Iran-aligned groups and somewhat atypical across the broader threat landscape, indicating a deliberate effort to modernize their toolset. The use of CNG allows for more sophisticated encryption and signing operations, further complicating analysis and detection.
MuddyWater has been active since at least 2017, primarily targeting government, military, telecommunications, and critical infrastructure sectors in the Middle East and North America. The group is linked to Iran's Ministry of Intelligence and National Security. Past notable operations include Operation Quicksand (2020) against Israeli entities and campaigns targeting political groups in Türkiye. The group has also shown operational overlap with Lyceum (an OilRig subgroup), as seen in a January–February 2025 campaign.
While MuddyWater campaigns have historically been noteworthy more for their targeting than for novel tools, this latest activity represents an unprecedented advancement in toolset and technical execution. The use of reflective loading, CNG API, and avoidance of interactive sessions suggests the group is investing in stealth and sophistication to achieve its espionage objectives.
ESET's findings provide detailed technical analyses of all tools used in the campaign, including the Fooder loader, MuddyViper backdoor, CE-Notes, LP-Notes, Blub stealer, and go-socks5 tunnels. The research underscores the evolving threat posed by Iran-aligned APT groups and the importance of continuous monitoring and advanced detection capabilities.