• ESET researchers have identified new MuddyWater (Iran-aligned cyberespionage group) activity primarily targeting critical infrastructure organizations in Israel, with one confirmed target in Egypt.
• The group used more advanced techniques to deploy MuddyViper, a new backdoor, by using a loader (Fooder) that reflectively loads it into memory and executes it.
• ESET provides technical analyses of the tools used in this campaign.

MONTREAL, BRATISLAVA — December 2, 2025 — ESET researchers have identified new MuddyWater activity primarily targeting organizations in Israel, with one confirmed target in Egypt. The victims in Israel were in the technology, engineering, manufacturing, local government, and educational sectors. MuddyWater, also referred to as Mango Sandstorm or TA450, is an Iran-aligned cyberespionage group known for its persistent targeting of government and critical infrastructure sectors, often leveraging custom malware and publicly available tools, and has links to the Ministry of Intelligence and National Security of Iran. In this campaign, the attackers deployed a set of previously undocumented, custom tools with the objective of improving defense evasion and persistence. New backdoor MuddyViper enables the attackers to collect system information, execute files and shell commands, transfer files, and exfiltrate Windows login credentials and browser data. The campaign leverages additional credential stealers. Among these tools is Fooder, a custom loader that masquerades as the classic Snake game.

In this campaign, initial access is typically achieved through spearphishing emails, often containing PDF attachments that link to installers for remote monitoring and management (RMM) software hosted on free file-sharing platforms such as OneHub, Egnyte, or Mega. These links lead to the download of tools including Atera, Level, PDQ, and SimpleHelp. Among the tools deployed by MuddyWater operators is also the VAX One backdoor, named after the legitimate software which it impersonates: Veeam, AnyDesk, Xerox, and the OneDrive updater service.

The group’s continued reliance on this familiar playbook makes its activity relatively easy to detect and block. However, in this case, the group also used more advanced techniques to deploy MuddyViper, a new backdoor, by using a loader (Fooder) that reflectively loads MuddyViper into memory and executes it. Several versions of Fooder masquerade as the classic Snake game, hence the designation, MuddyViper. Another notable characteristic of Fooder is its frequent use of a custom delay function that implements the core logic of the Snake game, combined with “Sleep” API calls. These features are intended to delay execution in an attempt to hide malicious behavior from automated analysis systems. Additionally, MuddyWater developers adopted CNG, the next-generation Windows cryptographic API, which is unique for Iran-aligned groups and somewhat atypical across the broader threat landscape. During this campaign, the operators deliberately avoided hands-on-keyboard interactive sessions, which is a historically noisy technique often characterized by mistyped commands. Thus, while some components remain noisy and easily detected, as is typical for MuddyWater, overall this campaign shows signs of technical evolution – increased precision, strategic targeting, and a more advanced toolset.

The post-compromise toolset also includes multiple credential stealers: CE-Notes, which targets Chromium-based browsers; LP-Notes, which stages and verifies stolen credentials; and Blub, which steals login data from Chrome, Edge, Firefox, and Opera browsers.

MuddyWater was first introduced to the public in 2017 by Unit 42, whose description of the group’s activity is consistent with ESET’s profiling – a focus on cyberespionage, the use of malicious documents as attachments designed to prompt users to enable macros and bypass security controls, and primarily targeting entities located in the Middle East.

Notable past activities include Operation Quicksand (2020), a cyberespionage campaign targeting Israeli government entities and telecommunications organizations, which exemplifies the group’s evolution from basic phishing tactics to more advanced, multistage operations; and a campaign targeting political groups and organizations in Türkiye, demonstrating the group’s geopolitical focus, its ability to adapt social engineering tactics to local contexts, and reliance on modular malware and flexible C&C infrastructure.

ESET has documented multiple campaigns attributed to MuddyWater that highlight the group’s evolving toolset and shifting operational focus. In March and April 2023, MuddyWater targeted an unidentified victim in Saudi Arabia, and the group conducted a campaign in January and February 2025 that was notable for its operational overlap with Lyceum (an OilRig subgroup). This cooperation suggests that MuddyWater may be acting as an initial access broker for other Iran-aligned groups.

For a more detailed analysis of the latest MuddyWater campaign, check out the latest ESET Research blogpost “MuddyWater: Snakes by the riverbank” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

Overview of Fooder loading MuddyViper or other supported payloads

• The ESET PROTECT console plugin for ConnectWise Asio opens up more options for MSPs.
• This integration empowers MSPs with better tools to perform their most common tasks more easily, saving them time while improving their legal and insurance requirements.
• MSP customers benefit thanks to easier issue solution and deeper automation options made available via this integration.

BRATISLAVA — November 07, 2025 — ESET, a global leader in cybersecurity solutions, today announced a new major integration of its ESET PROTECT Platform with ConnectWise Asio, a modern remote monitoring and management (RMM) solution.

Integrations are rather important these days, as neither vendors nor businesses can go about their daily duties without juggling a diverse set of solutions in their environments all at the same time. MSPs especially, whose task is to monitor several client environments with hundreds of seats each, might find it difficult to operate efficiently. Thus, by integrating their toolsets into unified solutions, they can make their jobs a whole lot easier.

MSPs usually play favorites, choosing a preferred RMM/PSA tool to do their job efficiently. ESET, as a partner and channel-focused cybersecurity vendor, understands this, and develops and maintains support for all the most prevalent RMM and PSA tools out there, with more coming in the future.

ConnectWise Asio is a new flagship product that enables one-click deployment of the ESET PROTECT management agent, helping MSPs stop threats proactively. By deploying ESET through ConnectWise’s product, MSPs can effectively streamline their security workloads by means of our powerful ESET Endpoint Security product, ESET Full Disk Encryption, or even the XDR-enabling component of the ESET PROTECT Platform, ESET Inspect, a powerful, AI-native detection and response solution.

With these capabilities at hand, MSP administrators supporting Windows machines will find their security tasks easier than before.

“ESET is a partner to thousands of MSPs. Thanks to the ESET MSP Program, we have a deep understanding of their needs and woes, for which we tirelessly seek to provide easy-to-use solutions. Many of our integrations are focused on streamlining MSP operations, as evidenced by our support of Kaseya VSA X, Datto RMM, or SuperOps’ unified PSA-RMM platform. With the ConnectWise Asio RMM integration, we remain firm in our commitment to help our MSP partners in the best way we can, by supporting their efforts and growth,” said Robert Jones, Global Channel Business Developer at ESET.

ESET cares about its MSP partners; therefore, our mission is to provide easy-to-use, highly functional integrations to work with their tools. It’s a symbiotic relationship, one that we hope to continue so we can keep sophisticated threats at bay and our MSP friends thriving without concessions.

Learn more about the ConnectWise Asio RMM.

Learn more about seamless ESET integrations to streamline your workloads.

Discover the AI-native power of the award-winning ESET PROTECT Platform and its modules.

Explore the benefits of the ESET MSP Program and partner with us to reap extensive rewards.

BRATISLAVA — October 28, 2025 — ESET, a global leader in cybersecurity, has been positioned as a Leader in the IDC MarketScape: Worldwide Consumer Digital Life Protection 2025 Vendor Assessment (doc #US52976725, October 2025). We believe that powerful yet lightweight technologies, paired with a comprehensive AI strategy, are among ESET´s greatest strengths.

According to the report,¹ “ESET is a suitable choice for individuals, families, and SOHO users seeking reliable and lightweight digital life protection. Its prevention-first approach is ideal for those who value proactive security measures that do not compromise device performance.”

ESET was recognized for the following strengths: “ESET’s focus on prevention allows it to proactively address threats through advanced technologies and real-time cloud protection. Its lightweight solutions are designed to maintain device performance while delivering effective security, which is particularly appealing to SOHO users who often rely on resource-constrained systems. The integration of artificial intelligence and human expertise enables ESET to adapt to evolving threats, ensuring its solutions remain relevant in a dynamic cybersecurity landscape.

The ESET HOME platform simplifies the management of security settings and devices. This centralized control is especially beneficial for SOHO users managing multiple devices, as it reduces complexity and enhances efficiency. ESET’s compatibility with multiple platforms ensures that users can protect a diverse range of devices, from smartphones to computers, making it a versatile option for both personal and professional use.”

Find out more about ESET’s results and get complimentary access to the IDC MarketScape: Worldwide Consumer Digital Life Protection 2025 Vendor Assessment excerpt.

If you would like to learn more about this recognition and ESET’s strengths in greater detail, feel free to read the dedicated ESET blog on this report. ¹IDC MarketScape: Worldwide Consumer Digital Life Protection 2025 Vendor Assessment, By Mike Jude, October 2025, Doc #US52976725  

• Lazarus targeted several companies active in the defense industry in Central and Southeastern Europe. Some of these are heavily involved in the unmanned aerial vehicle (UAV / drones) sector.
• Lazarus attacks against companies developing UAV technology align with recently reported developments in the North Korean drone program.
• The suspected primary goal of the attackers was likely the theft of proprietary information and manufacturing know-how.
• Based on the social-engineering technique used for initial access, trojanizing open-source projects from GitHub, and the deployment of ScoringMathTea, we consider these attacks to be a new wave of the Operation DreamJob campaign.

PRAGUE, BRATISLAVA — October 23, 2025 — ESET researchers have recently observed a new instance of Operation DreamJob — a campaign that ESET tracks under the umbrella of North Korea-aligned Lazarus group — in which several European companies active in the defense industry were targeted. Some of these are heavily involved in the unmanned aerial vehicle (UAV / drones) sector, suggesting that the operation may be linked to North Korea’s current efforts to scale up its drone program. The in-the-wild attacks successively targeted three companies active in the defense sector in Central and Southeastern Europe. Initial access was almost certainly achieved via social engineering. The main payload deployed to the targets was ScoringMathTea, a remote-access trojan (RAT) that offers the attackers full control over the compromised machine. The suspected primary goal of the attackers was exfiltration of proprietary information and manufacturing know-how.

In Operation DreamJob, the dominant theme of social engineering is a lucrative, but faux, job offer served with a side of malware: The target usually receives a decoy document with a job description and a trojanized PDF reader to open it. ESET Research attributes this activity with a high level of confidence to Lazarus, particularly because of its campaigns related to Operation DreamJob, and because the targeted sectors, located in Europe, align with the targets of the previous instances of Operation DreamJob (aerospace, defense, engineering).

The three targeted organizations manufacture different types of military equipment (or parts thereof), many of which are currently deployed in Ukraine as a result of European countries’ military assistance. At the time of Operation DreamJob’s observed activity, North Korean soldiers were deployed in Russia, reportedly to help Moscow repel Ukraine’s offensive in the Kursk region. It is thus possible that Operation DreamJob was interested in collecting sensitive information on some Western-made weapons systems currently employed in the Russia-Ukraine war. More generally, these entities are involved in the production of types of materiel that North Korea also manufactures domestically, and for which it might be hoping to perfect its own designs and processes. The interest in UAV-related know-how is notable, as it echoes recent media reports indicating that Pyongyang is investing heavily in domestic drone manufacturing capabilities. North Korea has relied heavily on reverse engineering and intellectual property theft to develop its domestic UAV capabilities.

“We believe that it is likely that Operation DreamJob was — at least partially — aimed at stealing proprietary information, and manufacturing know-how, regarding UAVs. The drone mention observed in one of the droppers significantly reinforces this hypothesis,” says ESET researcher Peter Kálnai, who discovered and analyzed these latest Lazarus attacks. “We have found evidence that one of the targeted entities is involved in the production of at least two UAV models that are currently employed in Ukraine, and which North Korea may have encountered on the front line. This entity is also involved in the supply chain of advanced single-rotor drones, a type of aircraft that Pyongyang is actively developing,” adds Alexis Rapin, ESET cyberthreat analyst.

Generally, Lazarus attackers are highly active and deploy their backdoors against multiple targets. This frequent use exposes these tools and enables their detection. As a countermeasure, the group’s tools are preceded in the execution chain by a series of droppers, loaders, and simple downloaders. The attackers decided to incorporate their malicious loading routines into open-source projects available on GitHub.

The main payload, ScoringMathTea, is a complex RAT that supports around 40 commands. Its first appearance can be traced back to VirusTotal submissions from Portugal and Germany in October 2022, where its dropper posed as an Airbus-themed job offer lure. The implemented functionality is the usual required by Lazarus: manipulation of files and processes, exchanging the configuration, collecting the victim’s system info, opening a TCP connection, and executing local commands or new payloads downloaded from the C&C server. Regarding ESET telemetry, ScoringMathTea was seen in attacks against an Indian technology company in January 2023, a Polish defense company in March 2023, a British industrial automation company in October 2023, and an Italian aerospace company in September 2025. It seems that it is one of the flagship payloads for Operation DreamJob campaigns.

The group’s most significant evolution is the introduction of new libraries designed for DLL proxying and the selection of new open-source projects to trojanize for improved evasion. “For nearly three years, Lazarus has maintained a consistent modus operandi, deploying its preferred main payload, ScoringMathTea, and using similar methods to trojanize open-source applications. This predictable, yet effective, strategy delivers sufficient polymorphism to evade security detection, even if it is insufficient to mask the group’s identity and obscure the attribution process,” concludes Kálnai.

The Lazarus group (also known as HIDDEN COBRA) is an APT group linked to North Korea that has been active since at least 2009. It is responsible for high-profile incidents. The diversity, number, and eccentricity in implementation of Lazarus campaigns define this group, as well as the fact that it performs all three pillars of cybercriminal activities: cyberespionage, cybersabotage, and pursuit of financial gain.

Operation DreamJob is a codename for Lazarus campaigns that rely primarily on social engineering, specifically using fake job offers for prestigious or high-profile positions (the “dream job” lure). Targets are predominantly in the aerospace and defense sectors, followed by engineering and technology companies, and the media and entertainment sector.

For a more detailed analysis of the latest Lazarus DreamJob campaign against the UAV sector, check out the latest ESET Research blogpost “Gotta fly: Lazarus targets the UAV sector” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

Examples of 2025 Operation DreamJob execution chains delivering ScoringMathTea