Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Boggy Serpens Threat Assessment

Summary: Unit 42 reports that Boggy Serpens, an Iranian MOIS-linked group also known as MuddyWater, has shifted from noisy spear phishing to hijacking legitimate internal accounts to bypass reputation-based filtering, a technique it used in over 15 attacks worldwide in the past year. The group ran four distinct attack waves against a single Middle East marine and energy company from August 2025 through February 2026, using department-specific lures and delivering new malware families including GhostBackDoor and the Nuso HTTP backdoor.

What you should know: Emails sent from a compromised internal account received a spam confidence level of -1 and bypassed spam filters entirely, so the trust your users place in a familiar sender is now the delivery mechanism. Four waves over six months against one maritime and energy target indicate a specific mandate to get inside regional infrastructure, not opportunistic spray-and-pray.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related