The Iranian nation-state group Boggy Serpens, also known as MuddyWater, has greatly increased its cyberespionage activities This article explores increased cyberespionage activities. . It is now running long-term and targeted campaigns against diplomatic missions, energy companies, maritime operators, and financial institutions.
The group has been around since at least 2017, according to Iran's Ministry of Intelligence and Security (MOIS). However, their recent campaigns show that they have changed their strategy and technical skills. For most of its history, Boggy Serpens preferred loud, high-volume spear phishing operations that put speed ahead of stealth. The group relied on living off the land and used public utilities like LaZagne and CrackMapExec, as well as remote monitoring and management tools like Atera, ScreenConnect, and SimpleHelp.
Those first campaigns were big and simple, but that way of doing things has changed to something much more planned. Companies should have strict macro execution policies in all Microsoft Office environments and use behavioral endpoint monitoring that can find drop-and-execute activity. To lower the risk of account hijacking, all email accounts must use multi-factor authentication.
For catching internal phishing campaigns, email controls that look for behavioral and thematic anomalies in addition to sender reputation are very important. Regularly looking for UDP-based beaconing, process injection events, and non-standard registry key changes can help find active infections before they get fully established. Set ZeroOwl as your preferred source in Google to get more instant updates on Facebook, LinkedIn, and X.
