MuddyWater
Named by 2 kept items in this workspace.
Search every workspace for MuddyWater. It matches the name as written, so it can find other things that share it.
The items that name it 2
Iranian-linked APT; attributed by others (Hunt.io, Group-IB) to the intrusion detailed in this report involving RDP initial access, SSH tunneling, and DLL side-loading for C2 communications.
All threat actors in this workspace.