malware

MuddyViper

S9032 · ATT&CK v19.2

Platforms

Windows

Tracked actors

Description

[MuddyViper](https://attack.mitre.org/software/S9032) is custom backdoor written in C and C++ used by [MuddyWater](https://attack.mitre.org/groups/G0069) for command and control (C2) communications and persistence. [MuddyViper](https://attack.mitre.org/software/S9032) is loaded by [Fooder](https://attack.mitre.org/software/S9033) and sends frequent messages to the C2 server.(Citation: ESET_MuddyWater_Dec2025)

Actors that use this

1 tracked actor

MuddyWaterATT&CK-attributed