MuddyWater's New BugSleep Malware – Iran's Cyber Retaliation Ramps Up

In this episode of the #SOCBrief, we break down BugSleep, a new backdoor malware tied to the Iranian threat group MuddyWater, and how it’s being used in targeted spear-phishing campaigns against organizations. 

Learn how the malware works, what indicators SOC teams should watch for, and practical steps to detect and defend against these evolving attacks. 

Transcript

SPEAKER_00 0:02

Good morning, good afternoon, or good evening, whenever you may be, and welcome to another episode of the SOC Brief. This is your go-to podcast for staying ahead of the ever-evolving world of cybersecurity threats. I'm your host, Andrew, and today we're going to discuss a timely development that's tying directly into our last episode regarding the US to Iran conflict, and that is the Iranian-linked hacking group Muddy Water, which is deploying a brand new backdoor malware called Bug Sleep against U.S. organizations. Amid escalating tensions, this is part of a broader surge in Iranian cyber operations. So we'll discuss how it works, some real-world examples, key indicators to hunt for, and some practical steps your SOC can take to spot these before they take hold. So, Muddy Water, which is also known as Seedworm or Temp Zagros, is an Iranian APT group tied to the Ministry of Intelligence and Security. They've been active since at least 2017, and they're espionage specialists. They're targeting governments, energy, and telecom in the Middle East, Europe, and now increasingly the US amid the ongoing conflict. Now there's a new tool they have named Bug Sleep. This one is a custom backdoor spotted by Symantec in late 2025, and these attacks are typically delivered via spear phishing emails with malicious PDFs or links leading to zips containing link files. Once clicked, it will infect Windows 7 through 11 systems with a multi-stage loader that establishes persistence through scheduled tasks and communicates over DNS or HTTP for commands like file exfill, screen grabs, or shell execution. With the US strikes and sanctions intensifying, Iranian groups are ramping up reprisals. The Bug Sleeps evasion tricks, they use things like random sleep delays and custom C code, show that they're adapting to beat Western defenses. The phishing lures being used are tailored and pretty convincing. They've ranged from fake job offers, conference invites, or policy updates aimed at aviation, transportation, and energy sectors so far. And they're aiming for high value disruption. Once bug sleep is run, it will set up persistence via scheduled tasks, C2 checks every three to five minutes. It'll do random sleeps to dodge behavioral patterns, uh, just to try to hide from EDR XDR systems, and it's capable of doing keystroke logging, credential theft, and possibly lateral movement. And these attacks are not random crime. They're typically targeted attacks. It's kind of a hint with the spear phishing, and it's state-backed threat actors here. So it's a lot of retaliation blending in with conflict escalation. So Muddy Waters hits a line with Iran's vows for harsh response. They're targeting US allies and critical infrastructure. For us, SOCS, it's keeping an eye out on phishing campaigns that look to come from internal sources in longer dwell times as bug sleep tries to hide in plain sight. Our detections are going to start with visibility. Tune your EDR XDR for any kind of LNK link anomalies. Watch for suspicious child processes from PDFs or zip spawning command or PowerShell processes. Flag unusual scheduled tasks like any slash create or DNS queries to odd domains. You want to block or quarantine high-risk attachments at email gateways and make sure you're enforcing app allow lists for executables and using sandboxes for unknown files. And uh, like in all things, uh, we just need to be proactive in the threat hunting. Search for bug sleep artifacts like random sleep loops or C2 beacons. And uh really cool thing is that Symantec and Syssa are both sharing IOCs like their hashes and domains that are being identified. Make sure you're integrating your threat intelligence feeds with all the muddy water TTPs. And for your organization, just spread the word internally. Uh, brief your team and especially high-risk users. Uh, let them know to watch for unsolicited invites or updates and verify senders on emails. Even if it looks benign, uh, just double check things. It will never hurt. We're even seeing Microsoft Teams being abused by these threat actors as well. And so that'll be things like uh if you have uh communications from external sources allowed, you know, they'll spoof a name and a phone number and try to call in and act as an IT group or IT department. Another thing you can do is run tabletop sins with spear phishing scenarios. And the bottom line on this one is bug sleep and muddy waters push really exploits conflict chaos. Socks can help defend against it with strict email controls, sharp hunting, and organization-wide education. Here's some closing thoughts and call to action on this one. With Muddy Waters Bug Sleep malware, just looking at everything that it's encompassing, it's a reminder that geopolitical conflicts will absolutely fuel cyber attacks. The state-backed hackers don't really need big budgets to have big impact. For SOCS, um, it's really about hunting proactively, block smartly, train and inform yourself relentlessly. That'll help you get in front of these threats before they can become a problem. And geopolitical tensions can make every alert seem critical for some business sectors. So uh just being advised there and knowing what to triage and how to handle it to try to prevent any kind of alert fatigue. This week, I would challenge everyone to hunt for one fishing anomaly in your logs and share a quick uh verify before-click tip with your end users, uh, especially those high-risk end users. And test an alert. It's a low effort with high reward type activity. And that's a wrap for this episode of the SOC Brief. Have questions or experience dealing with these types of attacks? Hit us up on social media or via our website. We're always happy to talk and share stories. And keep your eyes open, keep sharpening those skills, and we'll talk soon. Stay secure out there. Bye.