MuddyWater Infiltration Campaign Uncovered: Iranian Group Targets Jordan, Turkey and Azerbaijan

Security researchers uncovered a new campaign by the MuddyWater group — an advanced threat actor sponsored by Iran's Ministry of Intelligence and Security (MOIS) — targeting government and defense organizations in Jordan, Turkey and Azerbaijan. The campaign deployed two new custom backdoors: BugSleep (a lightweight implant establishing encrypted C2 communication) and Velho (a more sophisticated Python-based backdoor capable of screenshots, keylogging and persistent access). The campaign uses spear-phishing with legitimate document formats in local languages, impersonating government communications. This reflects growing geopolitical tensions and serves as a warning for organizations in countries with tense relations with Iran.