# MuddyWater: Snakes by the riverbank

DevFeed: [MuddyWater: Snakes by the riverbank](<https://devfeed.tech/articles/muddywater-snakes-by-the-riverbank-8376.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/>)

Author: ESET Research

Published: 2025-12-02T10:00:15Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [backdoor](<https://devfeed.tech/topics/backdoor.md>), [C++](<https://devfeed.tech/topics/c-plus-plus.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [api](<https://devfeed.tech/tags/api.md>), [apt](<https://devfeed.tech/tags/apt.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [c](<https://devfeed.tech/tags/c.md>), [c-c-plus-plus](<https://devfeed.tech/tags/c-c-plus-plus.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [critical-infrastructure](<https://devfeed.tech/tags/critical-infrastructure.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [iran](<https://devfeed.tech/tags/iran.md>), [malware](<https://devfeed.tech/tags/malware.md>), [memory](<https://devfeed.tech/tags/memory.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [socks5](<https://devfeed.tech/tags/socks5.md>), [techniques](<https://devfeed.tech/tags/techniques.md>), [tools](<https://devfeed.tech/tags/tools.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

ESET analyzes a MuddyWater campaign targeting organizations in Israel and Egypt that uses custom loaders, credential stealers, reverse tunnels, and the MuddyViper backdoor to evade defenses and maintain access.

## Source excerpt

MuddyWater targets critical infrastructure in Israel and Egypt, relying on custom malware, improved tactics, and a predictable playbook