Check Point Research documented in a report published on Check Point Research MuddyWater's deployment of BugSleep — a new tailor-made backdoor first observed in May 2024 — against organizations in Israel, Turkey, Saudi Arabia, India, Portugal, Azerbaijan, and Jordan. Since October 2023 and the start of the Israel-Hamas war, MuddyWater significantly increased activity, sending over 50 spear-phishing emails to hundreds of recipients across more than 10 sectors since February 2024. BugSleep partially replaces Atera Agent and Screen Connect RMM tools as the group's first-stage payload, with Israel-targeted campaigns receiving the custom backdoor while Saudi Arabia targets continued receiving RMM tools — delivered using identical lure content.
Phishing Infrastructure: Compromised Accounts, Egnyte Abuse, and Sector-Specific Lures
MuddyWater distributes phishing emails from compromised organizational email accounts, lending legitimacy to recipient validation. Lures are sector-tailored — Israeli municipalities received invitations to download a free "municipal app," airlines and travel agencies received travel-themed lures, and journalists received media-relevant content. More recent campaigns shifted to generic webinar/online course invitations in English, enabling cross-region lure reuse. Egnyte file-sharing subdomains are used to host ZIP archives, with the sender name displayed on the Egnyte share aligned to phishing campaign identity — in one case, a file shared to a Saudi transportation company appeared to come from "Khaled Mashal" (former Hamas head). Links are delivered either directly in emails or embedded within one-page PDF attachments.
BugSleep Technical Analysis: Subtraction Obfuscation, Mutex, Scheduled Task, 12 Commands
BugSleep opens with repeated Sleep API calls for sandbox evasion, then performs dynamic API loading before creating a mutex (observed values: "PackageManager" and "DocumentUpdater") and decrypting its configuration (C2 IP and port) using byte-subtraction with a hardcoded value. C2 communication uses the same cipher adding 3 to each byte modulo 256, with messages in [size][data] format. The initial beacon sends the victim identifier as [computer_name][username]. Twelve commands are supported including file upload (1), file write (2), reverse shell via cmd pipe until "terminate" (3), receive timeout update (4), communication stop (6), and scheduled task delete/check/create (9/10/11). Persistence is established via a scheduled task matching the mutex name (with the comment "sample comment") triggered every 30 minutes daily.
EDR Evasion: ProcessSignaturePolicy and ProhibitDynamicCode
One BugSleep version implements two process mitigation policy flags: MicrosoftSignedOnly via ProcessSignaturePolicy (blocking non-Microsoft-signed DLL injection) and ProhibitDynamicCode via ProcessDynamicCodePolicy (preventing dynamic code generation and executable code modification). The latter specifically targets EDR solutions that hook userland API functions for behavioral inspection. An optional custom loader injects BugSleep as shellcode (encrypted with subtraction value 6) into a running browser or utility process — msedge.exe, opera.exe, chrome.exe, anydesk.exe, OneDrive.exe, or powershell.exe — via WriteProcessMemory and CreateRemoteThread.
Active Development: Encryption Bugs, Unused Code, and Rapid Versioning
BugSleep shows signs of a trial-and-error development cycle with bugs across observed versions: some samples run the decryption algorithm (subtract 3) instead of encryption (add 3) in the send path; some API names were left unencrypted; an unexplained C:\users\public\a.txt create-then-delete code block appears in one version; and a newer sample fixed the encryption direction bug but only for some command handlers. The rapid iteration between versions with short intervals, the "sample comment" scheduled task artifact, and active bug-fixing cadence indicate ongoing development rather than a mature, field-tested implant.