Iran-Linked MuddyWater Group Exploits Hijacked Emails in Global Cyber Espionage Push

Global Phishing Campaign Leverages Compromised Email Accounts

Cybersecurity researchers have uncovered a sophisticated global phishing campaign that leverages compromised email accounts to distribute malware, according to reports from threat intelligence firm Group-IB. The espionage operation, attributed with high confidence to the Iran-linked threat actor known as MuddyWater, has targeted international organizations across multiple regions in what analysts suggest is an intelligence-gathering initiative.

Global Phishing Campaign Leverages Compromised Email Accounts
Sophisticated Attack Methodology
Expanded Malware Arsenal
Attribution and Geopolitical Context
Protective Measures and Future Outlook

Sophisticated Attack Methodology

The campaign utilized a compromised mailbox accessed through NordVPN, a legitimate service that sources indicate was misused to disguise the attacker’s identity. MuddyWater then sent phishing emails that mimicked authentic correspondence, exploiting established trust relationships to increase the likelihood of victims opening attachments. The report states that this approach demonstrates how state-backed threat actors continue to exploit trusted communication channels to evade defenses and infiltrate high-value targets.

Attackers distributed malicious Microsoft Word documents that urged recipients to enable macros, according to the analysis. Once activated, these macros executed embedded Visual Basic code that dropped and launched version 4 of the Phoenix backdoor, providing attackers with remote control over infected systems. The malware’s updated persistence mechanism allows MuddyWater to maintain control even after system reboots, investigators found.

Expanded Malware Arsenal

Beyond the Phoenix backdoor, researchers discovered three remote monitoring and management (RMM) tools—PDQ, Action1 and ScreenConnect—deployed within the campaign. Analysis also revealed a custom browser credential stealer dubbed Chromium_Stealer that masqueraded as a calculator application while harvesting login data from multiple browsers including Chrome, Edge, Opera and Brave.

The command-and-control infrastructure used in the operation was registered under the domain screenai[.]online, hosted via CloudFlare and reportedly active during August 2025. Technical analysis uncovered that the real IP address (159[.]198[.]36[.]115) was linked to NameCheap’s servers and utilized a temporary Python-based HTTP service to host malware and RMM utilities.

Attribution and Geopolitical Context

Group-IB connected this campaign to MuddyWater based on overlapping code, domain infrastructure and malware samples previously associated with the group. The targeting patterns, particularly those involving humanitarian and governmental institutions, reflect the actor’s geopolitical objectives, according to the report. The incident underscores ongoing cyber espionage trends targeting international organizations, with recent data showing significant increases in state-sponsored cyber operations globally.

Protective Measures and Future Outlook

Security analysts recommend organizations adopt enhanced security measures to reduce exposure to similar threats, including implementing macro restrictions, deploying advanced email filtering, and conducting regular security awareness training. “Given MuddyWater’s sustained focus on governmental targets especially amid the ongoing geopolitical tension in the region, we expect similar campaigns will continue to emerge, leveraging newly compromised accounts and evolving payloads,” Group-IB warned in their advisory.

The cybersecurity firm emphasized that organizations operating within government and critical infrastructure sectors should particularly strengthen their defenses against MuddyWater and similar state-aligned actors. The campaign represents the latest in a series of sophisticated operations attributed to Iranian threat groups targeting international entities for intelligence collection purposes.

References & Further Reading

This article draws from multiple authoritative sources. For more information, please consult:

This article aggregates information from publicly available sources. All trademarks and copyrights belong to their respective owners.

Note: Featured image is for illustrative purposes only and does not represent any specific product, service, or entity mentioned in this article.

As industrial systems face increasing cyber threats, AI-powered security solutions are shifting from generating alerts to providing contextualized answers. Learn how machine learning algorithms help security teams distinguish real threats from noise in critical infrastructure environments.

In 2025, artificial intelligence is fundamentally rewiring OT security approaches, transforming how industrial organizations handle the overwhelming flood of cybersecurity alerts. Following recent warnings from U.S. authorities about targeted attacks on industrial control systems across critical infrastructure sectors, security teams are increasingly turning to AI-powered solutions that provide contextual understanding rather than just notifications. This paradigm shift comes as organizations struggle with alert fatigue while facing tightened regulations like the EU’s NIS2 directive and similar guidance from the Cybersecurity and Infrastructure Security Agency.