Recent Muddy Water-associated Black Water campaign shows signs of new anti-detection techniques
Summary: Cisco Talos assesses with moderate confidence that an April 2019 campaign it calls BlackWater is associated with suspected persistent threat actor MuddyWater, which has been active since at least November 2017 and primarily targets entities in the Middle East. The campaign uses a password-protected, obfuscated VBA macro in a document titled "company information list.doc" to establish persistence in the Run registry key, then triggers a PowerShell stager that pulls a FruityC2-derived agent and sends base64-encoded host enumeration data back in the URL field rather than writing an "errors.txt" file.
What's compelling: The changes are superficial - variable names swapped to dodge Yara rules, results moved into the URL - yet Talos says they were significant enough to avoid some detection mechanisms, meaning signature-based controls tuned to the earlier samples would miss this one.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026