MuddyWater APT Uses Legitimate Remote Management Tool for Persistence

Group-IB's Threat Intelligence platform discovered in fall 2022 that MuddyWater, an Iranian-linked APT group, had begun deploying SimpleHelp — a legitimate remote device management tool — as a persistence mechanism on victim systems in the Middle East and Turkey. The group downloaded SimpleHelp directly from the official vendor website and installed it as a Windows service on compromised machines, giving operators persistent remote access that survives reboots. Group-IB published its full infrastructure analysis in April 2023, documenting 63 IP addresses linked to MuddyWater activity and a unique ETag-based server fingerprint the group leaves on its VPS infrastructure.

The campaign is attributed to MuddyWater, an Iranian state-sponsored threat group assessed to be a subordinate element of Iran's Intelligence Ministry (MOIS). The group is also tracked as TEMP.Zagros, Seedworm, Static Kitten, SectorD02, TA450, Boggy Serpens, and MERCURY. Group-IB linked the SimpleHelp activity to MuddyWater through confirmed IP address overlap with publicly known MuddyWater infrastructure, consistent ETag hashes across their VPS fleet, and a matching Cobalt Strike server linked to an active incident response case involving confirmed MuddyWater TTPs.

The primary goal was establishing persistent, covert remote access to victim systems for intelligence collection. By using a legitimate, digitally signed tool like SimpleHelp — rather than custom malware — MuddyWater can maintain long-term access that evades traditional security tools relying on malicious file detection. Once installed, operators can execute commands with administrator privileges, transfer files, and pivot through networks at any time, including after system reboots, with minimal forensic footprint.

Targeting covered organizations in the Middle East and Turkey, consistent with MuddyWater's broader focus on Iran's regional adversaries and neighboring states. Group-IB's top ten target countries for MuddyWater include Turkey, Pakistan, UAE, Iraq, Israel, Saudi Arabia, Jordan, USA, Azerbaijan, and Afghanistan. An active incident response case at a Middle Eastern organization in November 2022 confirmed deployment of Cobalt Strike linked to this infrastructure. A UAE Ministry of Health lure (mohap.gov.ae) was also identified, and a PowerShell backdoor was uploaded to VirusTotal from Kazakhstan, indicating active operations across the region.

MuddyWater's use of legitimate remote management tools is a deliberate strategy to bypass traditional security controls. Tools like SimpleHelp, ScreenConnect, RemoteUtilities, and Syncro are commercially available, digitally signed, and commonly used by IT departments — meaning antivirus and endpoint detection tools based on file signatures will not flag them as malicious. The tool runs as a persistent Windows service that survives reboots. When an operator connects, the session looks identical to a legitimate IT support session, making behavioral detection the only viable method for identification. This approach also gives the group plausible deniability since the tool itself is not weaponized.

Victims receive a spearphishing email — likely containing a link to a cloud storage service such as OneDrive, Onehub, or Dropbox — that delivers a SimpleHelp installer. Once the victim runs the installer, SimpleHelp installs itself as a persistent Windows service that automatically starts on reboot. MuddyWater operators then connect at any time through their SimpleHelp server, giving them full remote control of the victim's device including terminal access with administrator privileges, file transfer, and command execution. Post-access activity likely includes deployment of Fast Reverse Proxy (FRP) or Ligolo for network pivoting, and Cobalt Strike for deeper post-exploitation.

Group-IB identified that MuddyWater consistently uses the same set of components when provisioning web servers on purchased VPS infrastructure, leaving three unique HTTP ETag hashes behind: 2aa6-5c939a3a79153, 2aa6-5b27e6e58988b, and 2aa6-5c939a773f7a2. By searching for these ETag values using Shodan or Censys, defenders can proactively identify new MuddyWater servers before they are used in attacks. This technique allowed Group-IB to map 63 IP addresses linked to MuddyWater — most of which were previously unknown to the security community. The three ETag hashes can be added to threat hunting playbooks for continuous monitoring.