Novel UDPGangster backdoor leveraged in multi-country MuddyWater cyberespionage

Attacks with the new UDPGangster backdoor exploiting User Datagram Protocol for command-and-control have been launched by Iranian state-backed threat operation MuddyWater against Azerbaijan, Israel, and Turkey as part of a cyberespionage campaign, The Hacker News reports.

MuddyWater distributed spear-phishing emails, some of which spoofed the Turkish Republic of Northern Cyprus Ministry of Foreign Affairs, that included the malicious Word document "seminer.doc" and a ZIP file with the same document, which seeks macro activation for covert VBA code execution once opened, according to Fortinet FortiGuard Labs researchers.

While the VBA script moves to conceal illicit activity through a decoy disconnection notice from Israeli telecommunications firm Bezeq, the macro facilitates the eventual execution of the UDPGangster payload, which conducts several anti-analysis checks before obtaining system details, transmitting files, and running more illicit payloads.

Such findings come after MuddyWater was reported by ESET to have targeted multiple organizations across Israel with the MuddyViper backdoor.