Iranian nation-state actors have been observed using a previously unknown command-and-control (C2) framework, known as MuddyC2Go, as part of attacks targeting Israel.
“The web component of the framework is written in the Go programming language,” Deep Instinct security researcher Simon Kenin said in a technical report published Wednesday.
The tool has been attributed to Iranian state-sponsored hacking group Muddywater, which is affiliated with the country’s Ministry of Intelligence and Security (MOIS).
The cybersecurity firm said the C2 framework may have been put to use by the threat actor since early 2020, with recent attacks leveraging it in place of PhonyC2, another custom C2 platform from MuddyWater that came to light in June 2023 and has had its source code leaked.
Typical attack sequences seen over the past few years include sending spear-phishing emails that contain malware-laden archives or fake links that lead to the deployment of legitimate remote administration tools.
Installation of the remote administration software paves the way for the delivery of additional payloads, including PhoneyC2.
A new change in Muddywater’s methodology has since evolved into using password-protected archives to bypass email security solutions and distributing executables instead of remote administration tools.
“This executable includes an embedded PowerShell script that automatically connects to MuddyWater’s C2, eliminating the need for manual execution by the operator,” Kenin explained.
In turn, the MuddyC2Go server sends a PowerShell script, which runs every 10 seconds and waits for further commands from the operator.
Although the full extent of MuddyC2Go’s features is unknown, it is suspected to be a framework that is responsible for generating PowerShell payloads to conduct post-exploitation activities.
“We recommend disabling Powershell if it’s not needed,” Kenin said. “If it is enabled, we recommend close monitoring of PowerShell activity.”
