Unit 42 Details Boggy Serpens’ Trusted-Account Attacks and Malware
Summary
Unit 42 reports Boggy Serpens shifted toward hijacked trusted accounts and tailored phishing, detailing four campaign waves against a UAE marine and energy company and malware including Rust-based BlackBeard and LampoRAT.
Key points
- Unit 42 attributes the activity to Boggy Serpens, also known as MuddyWater, and assesses the group as aligned with Iran’s Ministry of Intelligence and Security.
- The researchers describe a shift toward hijacked government and corporate accounts to deliver targeted phishing that can bypass reputation-based email filtering.
- Four phishing waves targeted a UAE marine and energy company from August 2025 through February 2026, using lures tailored to engineering, finance, travel, and operational themes.
- The analysis links several tools to the group, including Rust-based BlackBeard and LampoRAT, plus UDPGangster, Nuso, and GhostBackDoor.
- Technical findings describe VBA macro droppers, process hollowing, custom persistence, and C2 over HTTP, UDP, and Telegram; researchers also observed manual command activity through UDPGangster in a controlled environment.
- Unit 42 says malware artifacts suggest AI-assisted development, while noting the evidence as an indication rather than definitive proof.
- The article recommends strict macro execution policies and behavioral monitoring, and describes Palo Alto Networks products’ claimed protections.
Article Details
- Attack Vectors
- Boggy Serpens hijacked legitimate government and corporate email accounts to send tailored spear-phishing attachments that bypassed reputation-based filtering.
- Malicious Office documents used blurred-content lures to persuade recipients to enable embedded VBA macros, which dropped and executed payloads.
- The group used custom email-distribution infrastructure and targeted lures tailored to recipients' departments and sectors.
- Reported payload delivery and command-and-control methods included HTTP/S, UDP, and the Telegram Bot API.
- Defensive Notes
- Do not rely solely on sender reputation or spam filtering; monitor for suspicious content and behavior in messages from authenticated internal accounts.
- Apply strict macro-execution policies and monitor Office processes for abnormal file drops, executable launches, and other suspicious child processes.
- Use behavioral monitoring to detect process injection, memory-resident payloads, and persistence through registry file associations or startup artifacts.
- Block access to malicious or compromised domains used for command and control and payload delivery.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bootcamptg[.]org | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | codefusiontech[.]org | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | maxisteq[.]org | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | miniquest[.]org | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | netivtech[.]org | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | nomercys[.]it[.]com | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | promoverse[.]org | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | reminders[.]trahum[.]org | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | screenai[.]online | Listed as command-and-control infrastructure used by Boggy Serpens malware. |
| DOMAIN | stratioai[.]org | BlackBeard command-and-control domain; the malware is reported to communicate with it over HTTP. |
| IPV4 | 157[.]20[.]182[.]75 | Host for a web-based email-delivery platform assessed to be used by Boggy Serpens to send target emails. |
| IPV4 | 159[.]198[.]66[.]153 | Listed among IP addresses observed as Boggy Serpens host and command-and-control infrastructure. |
| IPV4 | 159[.]198[.]68[.]25 | Listed among IP addresses observed as Boggy Serpens host and command-and-control infrastructure. |
| IPV4 | 46[.]101[.]36[.]39 | Listed as Phoenix command-and-control infrastructure. |
| IPV4 | 64[.]7[.]198[.]12 | Hardcoded UDPGangster command-and-control IP address. |
| SHA256 | 0be499354dc498248d27f6d186eb3bb75a607ae4a2c0a6734c76f1a1b7b1d316 | Hash of a BlackBeard variant identified as Reddit.exe. |
| SHA256 | 156b325231742a73ded4104fbde1c55ad3913d2eaf09b5194ef74c81ee3ba393 | Hash of a BlackBeard malware variant. |
| SHA256 | 1b9e6fe4b03285b2e768c57e320d84323ac9167598395918d56a12e568b0009a | Hash of a Nuso backdoor variant. |
| SHA256 | 1bcd8d7dc7bed5873bbdd2822e84e19773a33d659b16587ca9dc6db204447a86 | Hash of a Rust BlackBeard payload associated with the article's encryption-key analysis. |
| SHA256 | 47bb271c34210f52e3e08339a0c83688d9e9aa5c7cfc45b3e4bdffd1753f6cb2 | Hash of a loader/injector used in the reported malware activity. |
| SHA256 | 5ec5a2adaa82a983fcc42ed9f720f4e894652bd7bd1f366826a16ac98bb91839 | Hash of a Phoenix v4/Mononoke backdoor sample. |
| SHA256 | 668dd5b6fb06fe30a98dd59dd802258b45394ccd7cd610f0aaab43d801bf1a1e | Hash of a Phoenix v4/Mononoke backdoor sample. |
| SHA256 | 7523e53c979692f9eecff6ec760ac3df5b47f172114286e570b6bba3b2133f58 | Hash of a BlackBeard variant identified as Reddit.exe. |
| SHA256 | 81a6e6416eb7ab6ce6367c6102c031e2ae2730c3c50ab9ce0b8668fec3487848 | Hash of the LampoRAT remote access trojan. |
| SHA256 | 8d2227f2c53d7e22a57e12c45cecdd43dbec08dbc3ab93e74e6df52cdf80548b | Hash of a GhostBackDoor sample. |
| SHA256 | 9c207c51c448f96eaae91241a39c8bb85e2307f2d2a99244763a53176cf4c02f | Hash of a Nuso backdoor variant. |
| SHA256 | a2001892410e9f34ff0d02c8bc9e7c53b0bd10da58461e1e9eab26bdbf410c79 | Hash of a Rust payload identified as BlackBeard. |
| SHA256 | c91413ad7c94c0e2694862b9d671d1204873bf65576ba2cb91fbd562a4ccf79b | Hash of a Nuso backdoor variant. |
| SHA256 | cc2ec568f978f328b6de112670a1b35ca1f9db377ff32cb9d313a5b2ac3c127b | Hash of a BlackBeard malware variant. |
| SHA256 | fc4a7eed5cb18c52265622ac39a5cef31eec101c898b4016874458d2722ec430 | Hash of a UDPGangster payload. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelNuso exfiltrated system information in custom HTTP headers, and BlackBeard sent encrypted system data through its C2 channel.T1055 · Process InjectionThe BlackBeard stager decrypted its Rust payload and executed it in memory using process hollowing (RunPE).T1059.003 · Windows Command ShellLampoRAT passed received commands to a Windows command shell using cmd.exe.T1071.001 · Web ProtocolsBlackBeard and Nuso used HTTP/S for command-and-control communication, including Nuso's status-code-driven commands.T1078 · Valid AccountsThe group hijacked legitimate government and corporate accounts to send lures and bypass email filtering.T1102 · Web ServiceLampoRAT used the Telegram Bot API as its command-and-control channel.T1204.002 · Malicious FileLures prompted recipients to click “Enable Content,” triggering embedded VBA macros and payload execution.T1497.001 · System ChecksThe article describes anti-analysis checks and a CPU-intensive time loop intended to stall automated analysis.T1547.001 · Registry Run Keys / Startup FolderBlackBeard registered a file association and dropped Oregon.wdlp in the startup folder to trigger execution after restart.T1566.001 · Spearphishing AttachmentBoggy Serpens delivered malicious Office documents as spear-phishing attachments.
Threat Actors
Boggy SerpensThe article attributes cyberespionage campaigns, account hijacking, spear-phishing, and custom malware operations to Boggy Serpens; it assesses the group as Iranian state-aligned and subordinate to MOIS.Evasive SerpensThe article reports operational overlaps with Boggy Serpens in early 2025, which it says indicate shared resources and intelligence coordination.LyceumThe article explicitly identifies Lyceum as another name for Evasive Serpens and reports operational overlaps between that group and Boggy Serpens.MuddyWaterThe article explicitly identifies MuddyWater as another name for Boggy Serpens and attributes the same reported cyberespionage activity to the group.
Malware
BlackBeardTheir toolkit and techniques include BlackBeard, LampoRAT, UDPGangster, Nuso and GhostBackDoor, use of hijacked internal accounts, HTTP/Telegram C2 channels, VBA macro droppers and process hollowing for persistence.BugSleepThe Phoenix track represents the group’s primary development line, which delivers the Phoenix and BugSleep malware.GhostBackDoorTheir toolkit and techniques include BlackBeard, LampoRAT, UDPGangster, Nuso and GhostBackDoor, use of hijacked internal accounts, HTTP/Telegram C2 channels, VBA macro droppers and process hollowing for persistence.LampoRATTheir toolkit and techniques include BlackBeard, LampoRAT, UDPGangster, Nuso and GhostBackDoor, use of hijacked internal accounts, HTTP/Telegram C2 channels, VBA macro droppers and process hollowing for persistence.MononokePhoenix v4/MononokeNusoTheir toolkit and techniques include BlackBeard, LampoRAT, UDPGangster, Nuso and GhostBackDoor, use of hijacked internal accounts, HTTP/Telegram C2 channels, VBA macro droppers and process hollowing for persistence.OlalampoOur analysis uncovered another new tool used by Boggy Serpens – a remote access trojan (RAT) written in Rust named LampoRAT (also known as Olalampo).PhoenixTooling and implant delivery rely on VBA macro builders (Phoenix lineage and UDPGangster builders), AI-assisted code generation, Rust binaries, process hollowing and custom persistence via registry file associations andUDPGangsterTheir toolkit and techniques include BlackBeard, LampoRAT, UDPGangster, Nuso and GhostBackDoor, use of hijacked internal accounts, HTTP/Telegram C2 channels, VBA macro droppers and process hollowing for persistence.
Vendors
Products
Advanced DNS SecurityXSIAM, the Cortex Advanced Email Security module, Advanced WildFire, Advanced URL Filtering and Advanced DNS Security.Advanced URL Filteringthrough Cortex XDR and XSIAM, the Cortex Advanced Email Security module, Advanced WildFire, Advanced URL Filtering and Advanced DNS Security.Advanced WildFirediscussed in this article through Cortex XDR and XSIAM, the Cortex Advanced Email Security module, Advanced WildFire, Advanced URL Filtering and Advanced DNS Security.Cortex Advanced Email Securityprotected against the threats discussed in this article through Cortex XDR and XSIAM, the Cortex Advanced Email Security module, Advanced WildFire, Advanced URL Filtering and Advanced DNS Security.Cortex XDRPalo Alto Networks customers are better protected against the threats discussed in this article through Cortex XDR and XSIAM, the Cortex Advanced Email Security module, Advanced WildFire, Advanced URL Filtering andMicrosoft OfficeBuilding on recent findings by FortiGuard Labs, our analysis confirms that this malware is primarily delivered via Microsoft Office documents embedded with VBA macros.Microsoft WordThe lure displays a message claiming that the content was created in an older version of Microsoft Word or Excel.TelegramTheir toolkit and techniques include BlackBeard, LampoRAT, UDPGangster, Nuso and GhostBackDoor, use of hijacked internal accounts, HTTP/Telegram C2 channels, VBA macro droppers and process hollowing for persistence.XSIAMcustomers are better protected against the threats discussed in this article through Cortex XDR and XSIAM, the Cortex Advanced Email Security module, Advanced WildFire, Advanced URL Filtering and Advanced DNS
Tools
Atera(‘abusing legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect and SimpleHelp, alongside publicly available utilities such as LaZagne and CrackMapExec.’)CrackMapExec(‘abusing legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect and SimpleHelp, alongside publicly available utilities such as LaZagne and CrackMapExec.’)LaZagne(‘abusing legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect and SimpleHelp, alongside publicly available utilities such as LaZagne and CrackMapExec.’)ScreenConnect(‘abusing legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect and SimpleHelp, alongside publicly available utilities such as LaZagne and CrackMapExec.’)SimpleHelp(‘abusing legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect and SimpleHelp, alongside publicly available utilities such as LaZagne and CrackMapExec.’)
Countries
AzerbaijanUDPGangster (Target: Azerbaijan)EgyptRecent campaigns have struck entities in Israel, Hungary, Turkey, Saudi Arabia, the UAE, Turkmenistan, Egypt and South America.HungaryRecent campaigns have struck entities in Israel, Hungary, Turkey, Saudi Arabia, the UAE, Turkmenistan, Egypt and South America.IranBoggy Serpens (aka MuddyWater) is attributed to Iran’s MOIS and has prioritized long-term espionage against government, maritime, energy, telecom and finance sectors across the Middle East and beyond.IsraelIn February 2023, the group targeted the Technion Israel Institute of Technology, masquerading as the DarkBit ransomware gang.Saudi ArabiaRecent campaigns have struck entities in Israel, Hungary, Turkey, Saudi Arabia, the UAE, Turkmenistan, Egypt and South America.TurkeyRecent campaigns have struck entities in Israel, Hungary, Turkey, Saudi Arabia, the UAE, Turkmenistan, Egypt and South America.TurkmenistanRecent campaigns have struck entities in Israel, Hungary, Turkey, Saudi Arabia, the UAE, Turkmenistan, Egypt and South America.UAEto target diplomatic and critical infrastructure worldwide, highlighted by a four-wave campaign against a UAE marine and energy company.
Industries
AviationThe group’s targeting has expanded beyond government entities to encompass the maritime, aviation and financial sectors, reflecting a heightened interest in regional logistics and critical economic infrastructure.Energyand critical infrastructure worldwide, highlighted by a four-wave campaign against a UAE marine and energy company.EngineeringA sustained, multi-wave campaign (Aug 2025–Feb 2026) against a UAE marine and energy company demonstrates tailored lures (engineering, finance, travel, consumption reports) and iterative payload evolution.financeBoggy Serpens (aka MuddyWater) is attributed to Iran’s MOIS and has prioritized long-term espionage against government, maritime, energy, telecom and finance sectors across the Middle East and beyond.GovernmentBoggy Serpens (aka MuddyWater) is attributed to Iran’s MOIS and has prioritized long-term espionage against government, maritime, energy, telecom and finance sectors across the Middle East and beyond.MaritimeBoggy Serpens (aka MuddyWater) is attributed to Iran’s MOIS and has prioritized long-term espionage against government, maritime, energy, telecom and finance sectors across the Middle East and beyond.MilitaryAssessed to be a subordinate element of the MOIS, the group has primarily targeted government, military and critical infrastructure sectors across the Middle East, the Caucasus, Central and Western Asia, South AmericaTelecommunicationsOn Jan. 6, 2026, we observed a highly targeted attack against a major telecommunications provider in Turkmenistan. As shown in Figure 9, the threat actor used a compromised internal account info@<company_name>.tm to