Sekoia TDR analysts documented in a report published on Sekoia TDR a June 2024 MuddyWater campaign in which the group replaced its prior reliance on legitimate Remote Monitoring and Management (RMM) tools (Atera, SimpleHelp, Tactical RMM) with a new undocumented custom C implant dubbed MuddyRot. The shift likely reflects increased security vendor monitoring of RMM tool abuse. Targets include entities in Turkey, Azerbaijan, Jordan, Saudi Arabia, and Israel. The infection chain also evolved — from email-embedded links to ZIP archives, to PDF files with embedded links redirecting to Egnyte-hosted ZIP downloads.
MuddyRot: x64 C Implant with Subtraction-Based String Obfuscation and Dynamic API Loading
MuddyRot is a 64-bit Windows implant written in C. All relevant strings — configuration, file paths, and imported method names — are obfuscated by subtracting a small integer (3, 4, 5, or 6) from each character's decimal value. C2 communication uses the same subtraction obfuscation with the value fixed at 3. Anti-detection techniques include dynamic API loading via LoadLibrary / GetProcAddress using PE header InMemoryOrderModuleList traversal to locate and load functions from Kernel32.dll, Advapi32.dll, Ole32.dll, and Ws2_32.dll. A mutex named DocumentUpdater prevents multiple simultaneous executions.
Persistence: COM-Based Scheduled Task via CoCreateInstance to Evade schtasks.exe Monitoring
On execution, MuddyRot copies itself to C:\ProgramData\softwarememory\documentsmanagerreporter.exe and creates a scheduled task named DocumentsManagerReporter set to run daily at infection time plus one minute. To evade security solutions monitoring at and schtasks.exe, task creation uses CoCreateInstance with CLSID 0F87369F-A4E5-4CFC-BD3E-73E6154572DD (the Windows Task Scheduler COM class object) — a documented defense-evasion technique that bypasses process-level detection of scheduled task creation.
C2 Protocol: Raw TCP Port 443, Hostname/Username Fingerprint, 12 Command IDs
MuddyRot communicates via raw TCP on port 443. The initial beacon sends the victim fingerprint (hostname + "/" + username) as a length-prefixed packet: 4-byte size header followed by the obfuscated fingerprint. If the C2 responds with "-1" the implant exits; otherwise it enters an infinite command loop. Supported commands span file upload (0x1) and download (0x2) using an "exit" filename buffer, reverse shell (0x3), socket option updates (0x4/0x61), process kill (0x5), scheduled task delete/check/create (0x8/0x9/0xA), sleep interval update (0x60), and C2 ping-back (0x62). The reverse shell spawns cmd.exe with anonymous pipes redirecting stdin/stdout/stderr via STARTUPINFO handles, with a "terminate" command available to stop the shell. Reverse shell output is obfuscated by adding 3 to each byte (inverse of the receive deobfuscation).
Shift from RMM Tools to Custom Implant: Operational Context
MuddyWater's prior use of Atera, SimpleHelp, and Tactical RMM as first-stage validators offered broad functionality but became increasingly monitored by security vendors following widespread RMM abuse reporting. MuddyRot's emergence represents a return to homemade implants — similar to the earlier PowerShell-based Powerstats backdoor — with the tradeoff of narrower out-of-the-box functionality (file transfer handled awkwardly through the "exit" buffer file renamed via reverse shell) in exchange for reduced detection by security tools specifically hunting RMM software. The COM-based scheduled task creation and dynamic API loading reflect deliberate anti-detection engineering beyond what commodity RMM tools provide.