MuddyWater’s sharper toolkit, games, tunnels, theft

MuddyWater is back with a quieter, more disciplined playbook, and it comes packaged as a game. A new loader that mimics Snake feeds a backdoor that talks often but types rarely, a notable shift for an actor long known for noisy hands-on activity.

This piece distills what changed, how the pieces fit, and where defenders can turn that predictability into detections and disruption.

From noisy playbooks to scripted stealth

MuddyWater’s recent operations lean on pre-scripted chains that minimize interactive mistakes. A custom loader, frequently dressed up as the Snake game, reflectively injects a backdoor into memory, then idles on purpose. The idle is not random. It uses loop-based delays, the same rhythm a simple game engine would follow, plus frequent sleep calls. This decoy loop latency frustrates automated sandboxes that judge samples on how quickly they act, and it smooths the timing of outbound traffic, making beacons blend with routine noise. The group has also adopted the Cryptography Next Generation (CNG) Windows API to encrypt payloads and command traffic, a choice still uncommon across most threat families.

Consider a workstation where endpoint controls detonate attachments in a short-lived VM. The Snake-themed loader appears to run, prints a friendly banner, then idles in loops. The sandbox exits before the malicious branch executes, so no alert fires. On a live host, the same loader later pivots to a backdoor with credential theft and reverse-shell features. The causal mechanism is time gating, not code stunts. If the detonation window closes on schedule, payloads never reveal themselves.

Actionable starting point: hunt for executables that present a console banner, allocate memory sections, and then spend long stretches in sleep-heavy loops before making network calls via WinHTTP.

The toolchain that matters: loaders, backdoor, and helpers

Fooder, a loader that plays games

• Reflective loading keeps payloads off disk.
• Masquerades as Snake, complete with a welcome banner and game-like delay loops.
• Commonly the first native binary after an RMM installer foothold, it can also side-load open source tools on demand.

MuddyViper, chatty but cautious

• Executes commands, manages files, and spawns reverse shells through HTTP.
• Collects browser data by unpacking a known utility in memory, then compresses and uploads results.
• Displays a fake Windows Security prompt to harvest credentials, then validates them with Windows APIs.
• Persists via a scheduled task named ManageOnDriveUpdater or by nudging Startup folder paths.

Helpers that stage, not ship

• CE-Notes and LP-Notes pull browser secrets or prompt for Windows credentials, then stage encrypted blobs under Public\Downloads for later pickup.
• Blub targets multiple browsers, using SQLite for Chromium profiles and NSS libraries for Firefox. It writes cleartext to a local file and to console output, a surprising operational choice.

Concrete checks: look for the scheduled task label ManageOnDriveUpdater, staged files named ce-notes.txt or lp-notes.txt under Public folders, and processes that call CredUIPromptForWindowsCredentials from non-interactive parents. These are defender-controlled chokepoints where audit and quarantine can be applied without deep packet inspection.

Command and control, and the tunnels that hide it

Backdoor protocol tells

• HTTP GET on port 443 with an unusual twist, the request carries an encrypted body. That is rare in legitimate software and is a pragmatic hunting pivot.
• WinHTTP clients that keep the default example User-Agent often show up in these chains.
• Data is consistently formatted before encryption with a host and user tuple, which yields stable ciphertext sizes for the same tasking cadence.

Reverse tunnels with Go

• Custom builds around go-socks5 and session multiplexers shuttle traffic through victim hosts toward hardcoded controllers.
• This enables follow-on operators to route their C2 through infrastructure inside targeted networks, making geolocation and reputation less useful.

Example: a desktop with no admin tools open begins long-lived TLS sessions to small cloud providers, while a local process listens on an ephemeral port and rapidly accepts loopback connections from a helper binary. That pattern, listener plus client on the same host tied to opaque outbound TLS, strongly suggests a reverse proxy chain. This approach works when outbound egress is wide, TLS inspection is light, and host firewalls do not alert on local bind events. It fails if outbound to new autonomous systems is tightly reviewed or if JA3-like fingerprinting flags unpinned Go stacks that your estate does not use.

Overlap and brokerage risk: RMM-first access

Initial access still begins with spearphishing that links to remote monitoring and management installers on file-sharing sites. After the first RMM lands, operators sometimes add a second RMM package, then deploy custom loaders disguised as innocuous files. In some intrusions, activity after credential theft appears to shift to a different Iran-nexus crew, which fits an initial access broker pattern inside a shared ecosystem. The trade-off for defenders is clear. Block RMM installers outright, and IT may revolt or work around controls. Allow them without attestation, and you create a durable on-ramp for intrusion chains.

Operational claim to test: this actor will continue to prefer RMM-first access because it reduces development cost and increases plausible deniability. Expect them to rotate payloads behind the same delivery shape, rather than to rebuild the shape itself. This would not hold if mainstream RMM vendors enforce hardware attestation for silent installs, if enterprises require per-tenant allowlisting tied to certificates, or if cloud storage hosts tighten abuse response times enough that the link lifetime becomes too short to be useful.

Scenario, step by step: a quiet beachhead through an IT pretext

Consider a medium enterprise running Windows endpoints, a domain with default Kerberos, EDR on servers and desktops, email filtering, a proxy that allows direct HTTPS to common hosts, and no TLS inspection.

Trigger, T+0: A project coordinator receives a vendor-style email with a link to an RMM installer hosted on a free sharing site. The installer runs, creates a service, and phones home. Because the binary is signed and commonly used by legitimate IT, the EDR policy does not alert.

Cascade, T+4h: The operator pushes a small launcher named like a system updater. It duplicates a token from a user process, starts the Snake-themed loader, then reflectively loads a backdoor. The backdoor beacons over HTTPS using GET with a body, and immediately enumerates processes for security tools, creating a high volume of status messages. The EDR sees network noise but does not correlate it to new persistence.

Action, T+8h: The backdoor unpacks a browser data dumper in memory, zips the results, and exfiltrates in small chunks. A fake Windows Security prompt appears to the user, who enters credentials. The backdoor validates the login with Windows APIs, then increases tasking.

Response, T+12h: A defender hunting for GET-with-body over 443 from WinHTTP clients finds repeated beacons with stable response sizes. Host forensics reveal a scheduled task named ManageOnDriveUpdater and staged files under Public. The team isolates the host, revokes tokens, and searches for reverse tunnels by enumerating local listeners and correlating to long-lived outbound TLS.

Lesson: The control that failed was trust in signed RMM binaries unbound to a change ticket or per-tenant certificate. The control that worked was protocol-shape hunting across encrypted traffic.

What not to do

Anti-patterns that help the attacker

• Avoid blanket blocks of all RMM installers in the proxy, because admins will carve exceptions. Those exceptions become blind spots that an adversary can then target with renamed or repackaged installers.
• Avoid suppressing telemetry from WinHTTP clients because of false positives. The actor exploits default User-Agent strings and odd GET-with-body semantics. Filtering those events removes one of the few reliable network tells.
• Avoid hunting only for exfiltration volumes. Several components stage data locally without shipping it. Waiting for volume spikes misses the earlier and easier-to-catch staging writes to Public folders and odd scheduled task names.

Rule of thumb: do not create permanent allowlists for widely abused IT tools unless they are bound to attested packages, a specific certificate chain, and a change window. This fails if your packaging process cannot guarantee that binding, in which case pair temporary allowances with mandatory host telemetry collection and short review windows.

Quick wins and durable hunts

• Persistence sweep: enumerate scheduled tasks created by non-admin users, specifically names that mimic cloud updaters or storage services. Alert when the target path is within user profile trees.
• Credential prompt abuse: monitor CredUIPromptForWindowsCredentials and related APIs when called by processes that did not spawn from user interaction flows, for example, no foreground window or running as a service.
• Network shape: hunt for HTTP GET requests with non-empty request bodies over TLS, especially from processes using WinHTTP with the default example User-Agent. Pair with stable request or response sizes over time.
• Local staging: watch for new files named ce-notes.txt or lp-notes.txt under Public directories. If found, search for recent console applications that wrote verbose status messages and touched browser profile stores.
• Reverse tunnels: on endpoints, list listeners that are not system services and correlate them to outbound TLS to small cloud providers. Side by side loopback connect spikes plus new outbound sessions is a high-signal proxy pattern.

These hunts work when host telemetry includes API-level events and command lines, and when outbound destinations are logged with certificate metadata. They will be less effective if logging is minimal or if endpoint policies suppress console-only processes. In that case, prioritize tightening RMM intake, enforce per-tenant certificates, and require ticket-linked approvals for remote tool deployment.

Non-obvious contribution: MuddyWater’s shift introduced a detectable asymmetry, a telemetry tax. By replacing live operator typing with chatty status messages and scheduled loops, they reduced human error but increased predictable noise. That noise is a gift, if collected and queried with protocol-shape hunts and staged-data checks.