A MuddyWater phishing campaign used compromised mailboxes and macro-enabled Word documents to deliver a FakeUpdate loader that decrypts and injects Phoenix backdoor v4, establishing persistence and C2 communication. The operation also hosted a Chromium-based credential stealer and RMM tools on the same infrastructure, notably screenai[.]online, targeting government and regional entities in the Middle East and North Africa. #MuddyWater #Phoenix #FakeUpdate #screenai.online
Keypoints
- MuddyWater distributed macro-enabled Word attachments from a compromised mailbox accessed via NordVPN to deliver a multi-stage malware chain.
- VBA macros decode and write a loader (FakeUpdate) to disk, which AES-decrypts and injects Phoenix backdoor version 4 into its own process.
- Phoenix v4 establishes persistence by copying to C:ProgramDatasysprocupdate.exe and modifying the Winlogon Shell registry value under HKEY_CURRENT_USER.
- The backdoor collects system metadata, creates a mutex (sysprocupdate.exe), and communicates with C2 via WinHTTP to support file transfer and remote shell operations.
- Infrastructure at screenai[.]online hosted additional tools including PDQ and Action1 RMM and a Chromium_Stealer that exfiltrates browser credentials to C:UsersPublicDownloadscobe-notes.txt.
- Attribution to MuddyWater is supported by reuse of FakeUpdate and Phoenix families, shared VBA macro code, decoding routines, and overlapping C2 hosting with other regional operations.
- Victims include government (.gov) addresses and personal email accounts, with targeting focused on government and regional entities across the Middle East and North Africa and ties to energy-sector activity.
MITRE Techniques
- [T1193] Spearphishing Attachment – Malicious Word documents with VBA macros were sent via email; “…emails that mimic legitimate correspondence, prompting recipients to enable macros for viewing blurred content.”
- [T1204.002] User Execution: Malicious File – Victims enabled macros which executed VBA dropper code; “…embedded Visual Basic for Applications (VBA) code functions as a dropper, decoding and writing a loader to disk before execution.”
- [T1113] Screen Capture (credential stealer behavior) – A Chromium-based stealer enumerates browser profiles and extracts encrypted keys to steal credentials; “…enumerates browser profiles, extracts encrypted keys from Local State files using OS crypto APIs…decrypts login data.”
- [T1055.001] Process Injection: Dynamic-link Library Injection/Process Injection – FakeUpdate decrypts a payload and injects Phoenix into its own process; “…FakeUpdate injector to decrypt and inject Phoenix backdoor version 4…injecting it into its own process.”
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – Phoenix achieves persistence by modifying Winlogon Shell value in the registry; “…altering the Shell value in the registry key HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon.”
- [T1071.001] Application Layer Protocol: Web Protocols – Phoenix communicates with C2 via WinHTTP to poll for commands and perform uploads/downloads; “…connects to the C2 server via WinHTTP for command polling…supporting functions including sleep, file upload and download, shell execution…”
- [T1105] Ingress Tool Transfer – Additional tools (PDQ, Action1 RMM, Chromium_Stealer) were hosted on the same C2 server and retrieved by attackers; “…hosted PDQ RMM tools previously associated with the actor…an open directory on the server exposed additional utilities…”
Indicators of Compromise
- [File Hash ] Phoenix samples – 1883db6de22d98ed00f8719b11de5bf1d02fc206b89fedd6dd0df0e8d40c4c56, 3ac8283916547c50501eed8e7c3a77f0ae8b009c7b72275be8726a5b6ae255e3 (and 1 more hash)
- [Domain ] C2 and infrastructure – screenai[.]online used for hosting C2, RMM tools, and stealer artifacts
- [File Path / Name ] Installed backdoor and staging file – C:ProgramDatasysprocupdate.exe (Phoenix copy), C:UsersPublicDownloadscobe-notes.txt (stealer output)
- [Mutex ] Process artifact – sysprocupdate.exe mutex created by Phoenix v4
Read more: https://blog.polyswarm.io/muddywater-targets-mena-governments-with-phoenix-backdoor