Boggy Serpens Evolves Tactics: Hijacked Accounts and AI-Enhanced Malware Targeting Critical Infrastructure

A sophisticated cyberespionage group has been actively infiltrating various critical organizations across the globe using highly customized phishing campaigns. The attackers compromised trusted internal email accounts to send fake, malicious documents to employees, allowing them to secretly install advanced software to monitor systems and steal data. These attacks occurred in multiple persistent waves over several months.

The attacks are attributed to Boggy Serpens, a nation-state threat group also commonly known as MuddyWater. Cybersecurity researchers assess that this group operates as a subordinate element of the Iranian Ministry of Intelligence and Security (MOIS) and has been active since at least 2017.

The primary goal of these attacks is cyberespionage, meaning the attackers are focused on quietly gathering intelligence and stealing sensitive information over long periods. However, the group has also been known to conduct disruptive operations, occasionally disguising their state-sponsored intelligence gathering as financially motivated ransomware attacks.

While the attacks are highly tailored, the geographic scope is global. The group has targeted organizations across the Middle East, the Caucasus, Central and Western Asia, Europe, and South America, launching consecutive, multi-wave campaigns against specific high-value networks.

Yes, the attackers specifically targeted government ministries, diplomats, and critical infrastructure sectors, including energy, marine services, telecommunications, aviation, and finance. Within these organizations, they tailored their attacks to specific individuals and departments, such as project engineers, finance staff, and supply chain managers.

Attackers first hacked into legitimate email accounts belonging to government entities or corporate employees. They used these trusted accounts to send emails with attachments—like fake flight itineraries or financial reports—that instructed users to "enable content" to view blurred text. Once clicked, hidden tools were quietly installed on the victim's computer, allowing the attackers to take remote control and communicate with the infected machines using tools like the Telegram app.

The targeted organizations, such as national marine and energy companies, manage critical economic infrastructure and logistics. Infiltrating these networks provides the attackers' state sponsors with highly valuable strategic intelligence, insight into regional supply chains, and access to the communications of key geopolitical figures.

Organizations should strictly limit the use of Microsoft Office macros and enhance the monitoring of their internal email accounts to detect signs of compromise. Individuals should remain vigilant when receiving unexpected attachments—even from known colleagues or internal departments—and report any documents that ask them to "enable content" to view hidden or blurred information.