Skip to main content
عربي
logo

NCSC-TAD-2510-001

Severity Level: Critical
Malware

Reference No.: NCSC-TAD-2510-001CVSS 0

MuddyWater Deploys Phoenix Against Government Entities

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

MuddyWater used a compromised mailbox to send malicious documents to Government entities and international organizations across the Middle East and North Africa. The documents contained macros that deployed FakeUpdate and the Phoenix v4 backdoor, enabling persistent access, remote command execution, and intelligence gathering.

Affected Technologies

  • Microsoft Word

Mitigation and Immediate Actions

  1. 01

    Scan documents and test them in an isolated environment before users open them.

  2. 02

    Conduct regular phishing simulations and awareness training for personnel, emphasizing “enable content” macro lures.

  3. 03

    Disable Office macros by default through Group Policy and allow execution only from signed or trusted sources.

  4. 04

    Enforce Multi-Factor Authentication (MFA) across all accounts to prevent unauthorized mailbox access.

References