--- title: "Unmasking an Attack Chain of MuddyWater" url: https://daily.dev/posts/unmasking-an-attack-chain-of-muddywater-lkspumgyv source_url: https://www.huntress.com/blog/muddywater-attack-chain type: article source: "Huntress Blog" published: 2026-05-31T07:42:55.845Z updated: 2026-05-31T08:22:44.666Z reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Unmasking an Attack Chain of MuddyWater **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 5 min read · 0 upvotes · 0 comments ## Summary Huntress analysts uncovered a full intrusion timeline attributed to MuddyWater, an Iranian-linked APT, targeting an Israeli company. The attack chain began with RDP initial access, followed by reconnaissance commands (whoami, net, nltest), establishment of SSH reverse tunnels to 162.0.230[.]185, and deployment of malware via DLL side-loading — using the legitimate FMAPP.exe (Fortemedia Inc.) to load a malicious FMAPP.dll that communicated with C2 at 157.20.182[.]49. The detailed command timeline reveals attacker typos suggesting manual keyboard operation, deliberate process tree manipulation to appear legitimate, and C2 connectivity verification steps. IOCs including IP addresses, the SSH username, and file paths are provided. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Iran-Linked Hackers Hits Israeli Sectors with New MuddyViper Backdoor in Targeted Attacks](https://daily.dev/posts/iran-linked-hackers-hits-israeli-sectors-with-new-muddyviper-backdoor-in-targeted-attacks-2yw0reqpt) · The Hacker News · 0 upvotes · 0 comments - [MuddyWater Targets Orgs With Fresh Malware Amid Rising Tensions](https://daily.dev/posts/muddywater-targets-orgs-with-fresh-malware-amid-rising-tensions-pxdprestl) · Dark Reading · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/unmasking-an-attack-chain-of-muddywater-lkspumgyv)