MuddyWater-Linked Campaign Targets Middle Eastern Critical Infrastructure via Novel C2 and Vulnerability Weaponization

Researchers at Oasis Security identified a multi-stage cyberattack campaign starting in early February 2026. The attackers scanned more than 12,000 internet-facing systems for known vulnerabilities, then shifted to targeted credential theft and data theft against organizations in Egypt, Israel, the UAE, Portugal, and India. The campaign ultimately resulted in confirmed data being stolen from an aviation company in Egypt.

The campaign is attributed with medium-to-high confidence to MuddyWater, an Iranian state-linked threat group active since at least 2017. The attribution is based on the attack's command-and-control infrastructure sharing characteristics with the ArenaC2 framework previously associated with MuddyWater, as well as consistent multi-protocol communication patterns documented in prior MuddyWater operations.

The primary goals were intelligence collection and data theft. The attackers focused on stealing sensitive records — including passport and visa documents, payroll data, financial information, and internal corporate files — from high-value targets in the aviation, energy, and government sectors. The campaign's timing, beginning just ahead of escalating regional tensions in the Middle East, suggests it was aligned with Iranian strategic intelligence priorities.

The reconnaissance phase was wide — more than 12,000 internet-exposed systems were scanned globally. However, targeted intrusion attempts were regionally focused on the Middle East, specifically Egypt, Israel, and the UAE, with additional activity identified in Portugal and India. The confirmed data theft was limited to a single Egyptian aviation organization, though credential harvesting attempts were made against multiple organizations across these countries.

The campaign specifically targeted organizations in aviation, energy, and government — sectors with high operational and geopolitical significance. Confirmed victims and credential harvesting attempts were focused on entities in Egypt, Israel, and the UAE. An Egyptian aviation company suffered confirmed data theft. Government bodies and energy-sector organizations across the region were also targeted, reflecting the actor's interest in operationally sensitive infrastructure.

The attackers used a three-phase approach. First, they ran automated scans against more than 12,000 systems to identify those vulnerable to five newly disclosed software flaws. Second, they used custom scripts and tools to guess passwords on corporate email login pages (Outlook Web Access), gaining access to employee accounts. Finally, they installed modular command-and-control software on compromised systems, collected sensitive files, and transferred them to attacker-controlled servers hosted in the Netherlands — all while encrypting their communications to avoid detection.

Aviation, energy, and government organizations are priority targets for state-linked threat actors because they hold sensitive operational data, handle critical infrastructure, and carry significant geopolitical weight. For Iran-linked groups in particular, these sectors provide intelligence about regional military logistics, energy supply chains, and government operations — all of which have direct strategic value, especially during periods of heightened regional tension.