MuddyWater APT deploys PowGoop, Small Sieve targeting global sectors
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Iranian MOIS-linked MuddyWater APT conducts espionage using malware loaders and exploit known CVEs against government and commercial networks globally.
FBI, CISA, U.S. Cyber Command, and UK NCSC report sustained cyber espionage by MuddyWater, an Iranian Ministry of Intelligence and Security (MOIS) subordinate APT group active since approximately 2018. The group targets government and private-sector organizations across telecommunications, defense, local government, and energy sectors in Asia, Africa, Europe, and North America. MuddyWater operators employ spearphishing with malicious Excel macros and ZIP attachments, exploit publicly known vulnerabilities including CVE-2020-1472 (Netlogon) and CVE-2020-0688 (Exchange), and deploy a toolset including PowGoop (DLL-based loader using Google Update impersonation), Small Sieve (Python backdoor using Telegram API for C2), Canopy/Starwhale (WSF-based implant), Mori (DNS tunneling backdoor), and POWERSTATS (PowerShell persistence tool). The group uses DLL side-loading, obfuscated PowerShell scripts, and custom string obfuscation for defense evasion.
MuddyWater actors maintain persistence through registry run keys, side-loaded libraries, and PowerShell beacons. Small Sieve specifically impersonates Windows Defender and Microsoft Outlook in filenames to avoid detection and uses Telegram Bot API over HTTPS with hex byte-swapped encoding for command-and-control. The malware collects system information (IP, computer name, username) and can execute arbitrary commands. Defenders should prioritize patching CVE-2020-1472 and CVE-2020-0688, hunt for the IOC IP addresses and malware families listed, and monitor for spearphishing with Office macros and ZIP attachments.
Mentioned in this report
Detection guidance
Python Interpreter Connecting to Telegram Bot API
Python process making a network connection to api.telegram.org, consistent with Small Sieve Python backdoor C2 over the Telegram Bot API. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Python Interpreter Connecting to Telegram Bot API
id: dbdd1ffb-53cb-57bc-9b6d-2190a797692f
status: experimental
description: Detects python.exe or pythonw.exe connecting to the Telegram Bot API
over HTTPS. Small Sieve (MuddyWater) is a Python backdoor that uses the Telegram
API for C2. Generalises on the interpreter-to-Telegram relation, not on a specific
bot token or filename.
tags:
- attack.command-and-control
- attack.t1071.001
- attack.t1059.006
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \python.exe
- \pythonw.exe
DestinationHostname|contains: api.telegram.org
condition: selection
falsepositives:
- Legitimate Python-based Telegram bots or notification scripts run by developers
or admins
- Monitoring scripts that post alerts to Telegram
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
Google Update DLL Side-Loading from Non-Standard Location
goopdate.dll loaded from outside the legitimate Google Update install paths, matching PowGoop DLL side-loading via Google Update impersonation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Google Update DLL Side-Loading from Non-Standard Location
id: 5f5b8560-8841-5f03-92b3-6f5c7c2a78df
status: experimental
description: Detects goopdate.dll being loaded from a directory other than the legitimate
Google install paths. PowGoop (MuddyWater) uses a malicious DLL loaded by a copy
of the legitimate Google Update executable to masquerade as Google Update.
tags:
- attack.stealth
- attack.persistence
- attack.t1574.001
- attack.t1036.005
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: \goopdate.dll
filter_legit:
ImageLoaded|startswith:
- C:\Program Files\Google\
- C:\Program Files (x86)\Google\
filter_user_install:
ImageLoaded|contains: \AppData\Local\Google\
condition: selection and not 1 of filter_*
falsepositives:
- Google software installed to a custom non-default directory
- Portable Chrome or Google Update packaging unpacked in temporary directories
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
Office Excel Spawning Script Interpreter
Excel spawning PowerShell, WScript, CScript, MSHTA or Python, matching MuddyWater spearphishing with malicious Excel macros. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Excel Spawning Script Interpreter
id: 2a255498-7791-5f4c-a914-e27afbea8180
status: experimental
description: Detects Excel launching a script interpreter such as PowerShell, WScript,
CScript, MSHTA or Python. Matches malicious Excel macro attachments used by MuddyWater
to run obfuscated PowerShell or deploy loaders.
tags:
- attack.execution
- attack.t1204.002
- attack.t1566.001
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \EXCEL.EXE
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \python.exe
- \pythonw.exe
condition: selection
falsepositives:
- Finance or reporting workbooks with legitimate macros that call PowerShell or scripts
- Excel add-ins that invoke helper scripts
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs