# Boggy Serpens (MuddyWater) AI-Enhanced Cyberespionage Campaign Deploying Nuso, LampoRAT, BlackBeard, Phoenix, and UDPGangster Malware

> Iranian threat group Boggy Serpens (MuddyWater), a subordinate element of Iran's Ministry of Intelligence and Security (MOIS), has launched an extensive AI-enhanced cyberespionage campaign spanning August 2025 through February 2026. The operation deploys six custom malware families including the Nuso HTTP backdoor, Rust-based LampoRAT with Telegram C2, BlackBeard backdoor with AES-256-GCM encryption, Phoenix v4, UDPGangster with UDP-based C2, and the newly documented GhostBackDoor. Targets span government, military, energy, maritime, aviation, telecom, and finance sectors across the Middle East, Central Asia, and Europe.

- **Published:** 2026-03-16T12:00:00Z
- **Last reviewed:** 2026-03-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0238
- **ID:** TL-2026-0238
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 53 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Boggy Serpens, tracked by Palo Alto Networks Unit 42 as an Iranian state-sponsored threat actor subordinate to the Ministry of Intelligence and Security (MOIS), has significantly evolved its cyberespionage operations in a campaign running from August 2025 through February 2026. Active since at least 2017 and also known as MuddyWater, the group has shifted from its historical reliance on legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect, and SimpleHelp toward deploying custom-built malware families with sophisticated capabilities.

The campaign introduces six distinct malware families representing a major leap in tooling sophistication:

**Nuso (HTTP_VIP)** — A custom HTTP backdoor that uses dynamic API resolution to avoid Import Address Table (IAT) inspection. Commands are delivered via HTTP status codes: 201/204 trigger shell command execution, 210/222 update beacon intervals, and 350/404 signal termination. Data exfiltration occurs through bit-rotated custom HTTP headers (X-Computer-Name, X-Username). PDB paths containing the username 'nuso' and anti-analysis strings ('fuckAnalyzor') reveal developer artifacts.

**LampoRAT (Olalampo/CHAR)** — A Rust-based remote access trojan that masquerades as Kaspersky antivirus (avp.exe) with embedded Kaspersky metadata strings. It uses the Telegram Bot API for command and control with a hardcoded bot token, enabling malicious traffic to blend with legitimate encrypted HTTPS communications. The malware supports shell execution via cmd.exe and directory navigation. Notably, its use of emoji-based status indicators (checkmarks, crosses) in reporting strongly suggests AI-assisted code generation, as large language models frequently include such visual indicators by default.

**BlackBeard** — A Rust-based backdoor tracked by the Israeli National Cyber Directorate. It communicates with stratioai[.]org using the reqwest HTTP crate and encrypts exfiltrated system data with AES-256-GCM (hardcoded key and IV). HTTP response codes 201/202 trigger payload drops to C:\ProgramData\WebDeepPlayer.scr, while 418 signals exit. BlackBeard achieves persistence through a novel technique: registering a custom .wdlp file association in the registry (HKCU\Software\Classes\.wdlp) that triggers WebDeepPlayer.scr execution, combined with dropping Oregon.wdlp in the startup folder. It also scans %PROGRAMDATA% for 15+ security products to fingerprint the target environment.

**Phoenix v4 (Mononoke)** — The evolution of the group's established Phoenix backdoor family. It employs property-based payload encapsulation in VBA UserForm1.TextBox1 controls, hex-shift rotation cipher decryption, and a drop-rename-execute workflow (writing payloads as .log or .txt files before renaming to .exe). Phoenix implements both WMI (Win32_Process.Create) and Windows API (CreateProcessW) execution to decouple from Office parent processes, evading parent-child process monitoring. It includes a brute-force CPU stalling function executing 100+ million operations to timeout automated analysis tools.

**UDPGangster** — A lightweight backdoor using a custom UDP-based C2 protocol on non-standard ports (1269/1259). It features anti-analysis detection of research environments and delivers commands via byte prefixes (0x0A for named pipe creation). Reconnaissance capabilities include nslookup, ipconfig, dir, and Quser commands. Live operator interaction was observed approximately 12 hours post-infection at ~17:00 Iranian time. Distinct PDB path usernames (gangster, piper, surge) map to specific target sectors: Israel aviation, Azerbaijan finance, and Israel telecom respectively.

**GhostBackDoor** — A newly documented advanced implant enabling remote control and file access, deployed via personalized social engineering lures.

The campaign's initial access vector consistently relies on spear-phishing with malicious macro-enabled Office documents distributed from compromised legitimate accounts, including Omani Ministry of Foreign Affairs and internal corporate email accounts. This technique achieves negative spam confidence levels (SCL -1), bypassing reputation-based email filtering. Documents use blurred content overlays with 'older version' messages to trick users into clicking 'Enable Content', triggering VBA macro execution.

Four distinct attack waves were documented against a single UAE-based energy and maritime company with strategic ties to Saudi Aramco: an engineering-themed campaign (August 2025), financial department targeting with Excel lures (January 2026), personalized Air Arabia flight reservation lures using exfiltrated passenger data (January 2026), and operational logistics documents delivering the new Nuso backdoor (February 2026).

Boggy Serpens also operates a custom-built mass email orchestration platform observed on 157.20.182[.]75:5000, providing a Python web interface for automated phishing delivery with granular control over sender identities, target lists, SMTP configuration, and attachment management.

The campaign demonstrates operational overlaps with Evasive Serpens (Lyceum/OilRig subgroup), indicating shared resources and intelligence coordination within Iran's broader cyber threat landscape. The group's integration of AI-assisted development workflows, particularly evident in LampoRAT's emoji-based logging, enables parallel development tracks that sustain high operational tempo across multiple simultaneous campaigns.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1586 Compromise Accounts
- T1566 Phishing
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1112 Modify Registry
- T1620 Reflective Code Loading
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1018 Remote System Discovery
- T1518 Software Discovery
- T1115 Clipboard Data
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Unit 42 Boggy Serpens Threat Assessment](https://unit42.paloaltonetworks.com/boggy-serpens-threat-assessment/)
- [HivePro - Operation Olalampo: MuddyWater Expanding Campaign Across MENA](https://hivepro.com/threat-advisory/operation-olalampo-muddywater-expanding-campaign-across-mena/)
- [Group-IB - Unmasking MuddyWater New Malware Toolkit Driving International Espionage](https://www.group-ib.com/blog/muddywater-espionage/)
- [Israeli National Cyber Directorate - MuddyWater Internal Account Compromise Advisory](https://www.gov.il/en/departments/israel-national-cyber-directorate)
- [Malpedia - MuddyWater Threat Actor Profile](https://malpedia.caad.fkie.fraunhofer.de/actor/muddywater)
- [MITRE ATT&CK - MuddyWater Group Profile (G0069)](https://attack.mitre.org/groups/G0069/)
- [Unit 42 Timely Threat Intel - Boggy Serpens AutodialDLL](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-Boggy-Serpens-use-of-AutodialDLL.txt)
- [CISA - Iranian Government-Sponsored APT MuddyWater](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0238