Muddying the Water: Targeted Attacks in the Middle East
Summary: Unit 42 documented targeted attacks against Middle Eastern nations, plus targets in India and the USA, between February and October 2017 by a group it named MuddyWater, characterized by a slowly evolving PowerShell-based first-stage backdoor called POWERSTATS. The attackers used decoy documents with local government logos to prompt users to enable macros, hosted their custom backdoor in GitHub repositories populated with forked code, and in some cases sent malicious documents built from files stolen from compromised third-party accounts.
Why it matters: Unit 42 concluded the activity was espionage and unlikely to be FIN7, despite prior public reporting tying it to FIN7 through a single DNSMessenger download - a reminder that attribution built on one shared, publicly available tool can send defenders chasing the wrong actor.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026