MuddyWater's Cyber Arsenal: From PowGoop to Mori Backdoor

US Cyber Command's Cyber National Mission Force published an advisory on January 12, 2022, disclosing a suite of malware tools used by MuddyWater — an Iranian state-sponsored threat group that operates as a subordinate of Iran's Ministry of Intelligence and Security. The advisory identified multiple variants of the PowGoop malware loader and the Mori backdoor, and released file samples to VirusTotal to help defenders detect and respond to these tools. MuddyWater had been using these tools in networks across the Middle East, Europe, and North America for espionage purposes.

The tools are attributed to MuddyWater, an Iranian threat group assessed by US Cyber Command to be a subordinate element of Iran's Ministry of Intelligence and Security (MOIS). MuddyWater has been active since at least 2017 and is known for targeting government agencies, telecommunications providers, defense contractors, and critical infrastructure organizations across the Middle East, Europe, and North America. The CNMF advisory represents a rare direct US government attribution of specific malware tools to an Iranian intelligence body.

The primary goal was espionage — gaining and maintaining persistent access to victim networks to collect intelligence on behalf of the Iranian government. PowGoop provides a persistent loader that silently runs obfuscated PowerShell C2 scripts, while Mori gives attackers a stealthy DNS-based backdoor for long-term access. The advisory notes that PowGoop has also been associated with ransomware in some cases, suggesting MuddyWater may use the same tooling opportunistically for disruptive operations beyond intelligence collection.

MuddyWater has primarily targeted Middle Eastern nations, with significant focus on government agencies, defense organizations, and telecommunications providers across Turkey, Saudi Arabia, Iraq, Israel, UAE, Jordan, and Egypt. The group has also targeted European and North American organizations. US Cyber Command's advisory reflects the global reach of the campaign — the tools were identified on compromised networks worldwide.

MuddyWater's consistent targeting profile spans government agencies, telecommunications providers, defense contractors, universities, and critical infrastructure organizations. These sectors align directly with Iran's MOIS intelligence collection mandate — monitoring regional rivals, tracking foreign policy decisions, and surveilling activists and dissidents abroad. The advisory notes that MOIS also uses these capabilities domestically to identify regime opponents.

PowGoop uses DLL side-loading — a technique that exploits how Windows loads software libraries. The attackers place a malicious goopdate.dll in the same directory as the legitimate Google Update application (GoogleUpdate.exe). When Google Update runs, Windows automatically loads the malicious DLL instead of the real one. The DLL then reads and deobfuscates a .dat file, which is a PowerShell script that in turn decodes a config.txt file — another PowerShell script that establishes communication with the attacker's C2 server using a modified Base64 encoding scheme. The Mori backdoor takes a different approach: it is loaded via regsvr32.exe and uses DNS tunneling to communicate with C2 infrastructure, creating a mutex (0x50504060) and a registry key (HKLM\SOFTWARE\NFC) during operation.

DLL side-loading is a powerful evasion technique because the malicious DLL runs inside a trusted, legitimate process — in this case Google Update — making it much harder for security tools to flag. The multi-stage PowerShell deobfuscation chain (goopdate.dll → .dat → config.txt) means no single file contains the full malicious payload, reducing the chance of signature detection. Variant DLL names like libpcre2-8-0.dll and vcruntime140.dll further evade antivirus tools looking for known-bad filenames. Mori's DNS tunneling similarly hides C2 traffic inside a protocol that most organizations cannot afford to block, and the traffic blends with normal DNS queries.