MuddyC2Go
Description
(Deep Instinct) While analyzing previous PhonyC2 infrastructure, Deep Instinct uncovered anomalies that indicated MuddyWater might be using an additional C2 framework. At that time, we lacked sufficient evidence to support this claim. However, after we published our PhonyC2 research, we observed two IP addresses previously related to MuddyWater, one of those addresses which was hosting PhonyC2 had switched to a different C2 framework delivering a PowerShell payload. This behavior heightened suspicions of a new C2 framework. However, without seeing and observing the initial payload, those IP addresses could have been internal tests by MuddyWater before fully deploying the C2.
Names
| Name |
|---|
| MuddyC2Go |
Category
Malware
Type
- Backdoor
Information
Malpedia
Other Information
Uuid
84270a76-a828-4e46-a343-6ac3015f7afc
Last Card Change
2024-01-17