- A large-scale cyber campaign showing notable similarities to the MuddyWater threat group has been identified
- It was seen targeting thousands of internet-facing systems before focusing on high-value organisations in the Middle East
- Oasis Security traced the attacker’s infrastructure to a server hosted in the Netherlands
A large-scale cyber campaign showing notable similarities to the MuddyWater threat group has been identified targeting thousands of internet-facing systems before focusing on high-value organisations in the Middle East.
Security researchers say the operation scanned more than 12,000 exposed systems across multiple regions, with particular attention given to sectors such as aviation, energy and government. At least one aviation organisation in Egypt is confirmed to have suffered data theft as part of the activity.
The campaign is believed to have begun in early February 2025, coinciding with rising geopolitical tensions in the region. Analysts suggest the timing may indicate a strategic motive rather than purely opportunistic cybercrime.
Rather than relying on a single breach, attackers used a staged approach. The first phase involved widespread scanning for vulnerabilities, followed by targeted attempts to harvest credentials, before moving on to data exfiltration from compromised systems.
To support the initial reconnaissance, the attackers exploited five recently disclosed software vulnerabilities affecting a range of platforms, including web applications, email services and IT management tools. These weaknesses allowed the group to identify and potentially access poorly secured systems at scale.
The campaign was analysed by researchers at Oasis Security, who traced the attacker’s infrastructure to a server hosted in the Netherlands. Examination of the system revealed a collection of scripts, command-and-control components and evidence of coordinated scanning activity.
Following the reconnaissance phase, the attackers shifted to credential harvesting, using brute-force techniques against Outlook Web Access systems. Custom tools and automated software were deployed to test usernames and passwords against targeted organisations, particularly in Egypt, Israel and the United Arab Emirates.
In one case, employee login details were successfully obtained from an Egyptian organisation, while lists of administrator accounts were also identified in a UAE-based target. These credentials appear to have been used to facilitate deeper access into internal systems.
The campaign progressed to confirmed data theft, with around 200 files reportedly extracted from an Egyptian aviation entity. The compromised data included sensitive personal and corporate information such as passport records, payroll data, credit card details and internal documents.
Although the primary focus was the Middle East, additional targets were identified in countries including Portugal and India, suggesting the operation had a broader global reach.
Researchers also highlighted the technical sophistication of the attackers’ command-and-control infrastructure. The system was designed with multiple layers and built using a mix of programming languages and communication methods, making it more resilient to disruption.
This infrastructure enabled compromised machines to communicate with attacker-controlled servers through various channels, including encrypted web traffic and custom protocols. The design allowed the operation to continue functioning even if parts of the network were detected or taken down.
The communication patterns observed closely resemble tools and techniques previously associated with MuddyWater, strengthening the suspected link to the group.
Security experts are urging organisations to apply patches for the identified vulnerabilities without delay and to monitor systems for unusual login activity. Additional recommendations include reviewing email access logs, restricting suspicious outbound connections and checking for signs of large-scale data staging, which may indicate preparation for further data theft.
