H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[MuddyViper](https://attack.mitre.org/software/S9032) is custom backdoor written in C and C++ used by [MuddyWater](https://attack.mitre.org/groups/G0069) for command and control (C2) communications and persistence. [MuddyViper](https://attack.mitre.org/software/S9032) is loaded by [Fooder](https://attack.mitre.org/software/S9033) and sends frequent messages to the C2 server.(Citation: ESET_MuddyWater_Dec2025)

Labels

malware

19 recorded

Relationships

uses

to Archive Collected Data

Technique

uses

to Command and Scripting Interpreter

Technique

uses

to Delay Execution

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to GUI Input Capture

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Reflective Code Loading

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Symmetric Cryptography

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

from MuddyWater

Group

2 external

References

mitre-attack

S9032

ESET_MuddyWater_Dec2025

https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/