Singapore-based cybersecurity company Group-IB says hackers tied to Iran carried out a sophisticated global phishing campaign to steal sensitive data from international organizations.
In a detailed report released Wednesday, the firm accused MuddyWater of using compromised email accounts and legitimate internet tools to make its messages appear authentic.
“The incident underscores how state-backed threat actors continue to exploit trusted channels of communication to evade defenses and infiltrate high-value targets,” Group-IB said in a statement.
The attackers reportedly gained access to a corporate email account through NordVPN, a popular virtual private network service, and used it to send fake messages to multiple targets worldwide.
These emails contained malicious Microsoft Word attachments disguised as genuine correspondence.
When recipients opened the files, they were prompted to “enable content” — a step that secretly triggered harmful code. The code then installed malware known as the Phoenix backdoor, allowing the hackers to remotely control infected computers, collect data, and conduct further spying activities.
“By exploiting the trust and authority associated with legitimate correspondence, the campaign significantly increased its chances of deceiving recipients,” the firm added.
Group-IB said it linked the attack to MuddyWater with “high confidence,” based on the technical tools and methods used.
The Phoenix backdoor identified in this operation was version 4 of the malware, suggesting continued development by the group.
MuddyWater has been active since at least 2017 and is believed to operate under Iran’s Ministry of Intelligence and Security.
The group has previously targeted government agencies, energy firms, and telecommunications companies across the Middle East, Europe and North America.
Iran faces stark economic and geopolitical challenges as a lingering impasse over its nuclear program led to the resumption of European-triggered international sanctions last month.
Western countries have called for Tehran to engage in renewed diplomacy with Washington and restored access to international nuclear inspectors.
Speaking at a seminar on “resistance diplomacy” at Ferdowsi University in Mashhad, Esmail Baghaei said: “We must use all tools to protect the country’s rights -- whether through missiles or diplomacy and negotiation.”
“The concept of resistance has now evolved and taken the form of resilience,” he said, adding that that Iran’s approach combines self-reliance with international engagement.
His comments appeared to strike a relatively moderate tone, two days after Iran's ultimate decision-maker Supreme Leader Ali Khamenei appeared to reject a peace overture by President Trump and deployed sharp language at his nemesis.
The 86-year-old veteran ruler called Trump's repeated assertions that US attacks on June 22 had obliterated Iran's nuclear program "nonsense" and in a rare direct address to a US President told him to "keep dreaming."
Khamenei appeared to rule out renewed talks, calling reported US demands for curbs to Iranian missile ranges and Tehran's support for regional armed groups bullying and a
Baghaei said Iran faces powerful adversaries but remains capable of shaping developments within the international system.
“Our opponents invoke international law to justify their actions, so we must also rely on the same law to prove our rights,” he said. “Resistance diplomacy must be seen as an active instrument to secure national interests.”
He defended Tehran’s stance in the wake of the UN sanctions snapback mechanism, saying that Western powers had expected immediate compliance but were surprised by global resistance to reimposing restrictions.
Support for regional groups
Addressing Iran’s backing of allied groups in the region, Baghaei rejected the notion that Tehran created “proxy” groups.
“We did not create them,” he said. “The issues of Palestine and Lebanon did not begin in 1979 (when the Islamic Republic was established). These movements existed long before, and we have supported them based on our constitutional and strategic principles.”
Baghaei added that Iran’s support is “based on a defined framework” and that “to prevent harm, we must build allies within the international system.”
He said the resilience of such movements is enduring despite repeated attempts to weaken them.
“After two years, those who claimed resistance was finished end up sitting at the same table with them,” he said. “The foundations of resistance are deeply rooted and cannot be easily destroyed.”
On diplomacy and international law
Baghaei also defended Iran’s record on diplomacy, citing past cooperation with global institutions and negotiations with Washington.
He recalled that after the US withdrawal from the 2015 nuclear deal, Iran “remained committed for months” before gradually reducing compliance.
He also noted that indirect talks with the United States had taken place under both Trump and Biden but collapsed due to continued sanctions and regional tensions.
“When one side plans an attack and then invites you to a meeting, how can you attend such a session?” he said, referring to recent incidents.
In an interview with ISNA, Shamkhani said national cohesion was vital in the face of external pressure and domestic challenges.
“We are all in the same boat shaped by the sacrifices of the martyrs of the Islamic Revolution, and it would be a shame if our differences created weaknesses,” he said.
He urged all political groups to “act together under the leadership of the Supreme Leader,” adding that adversaries were trying to exploit divisions to harm the country.
The comments came just days after footage surfaced online showing Shamkhani escorting his daughter at a wedding ceremony in a Tehran luxury hotel.
The video, shared widely on X since mid-October, appeared to show a large, Western-style celebration and drew sharp criticism from social media users accusing officials of hypocrisy amid the country’s deepening economic crisis and renewed enforcement of hijab rules.
The wedding reportedly took place in April 2024 at Tehran’s Espinas Palace Hotel. At the time, Iranian outlets estimated the cost at about 14 billion rials (over $21,000). The family did not comment on the reports, and Shamkhani has not publicly addressed the new controversy surrounding the footage.
Shamkhani, a former secretary of Iran’s Supreme National Security Council and now a member of the Expediency Council, has long been a prominent figure in Iran’s security establishment. He also serves as the Supreme Leader’s representative in the National Defense Council.
Leak fuels political blame game
The video has drawn reactions even from hardline circles. Some conservative commentators questioned how senior officials could call for patience under sanctions while appearing at opulent private events. Others defended Shamkhani, saying the ceremony was private and attended only by family members.
Former state broadcaster chief Ezzatollah Zarghami described the exposure as “a new method of assassination,” accusing Israel of waging psychological warfare through cyberattacks. IRGC-linked Mashregh News also said the leak aimed to “undermine an effective official,” blaming both “foreign enemies and certain domestic circles.”
The hardline daily Kayhan, which is funded by the Supreme Leader’s office, went further, accusing allies of former president Hassan Rouhani and ex-foreign minister Mohammad Javad Zarif of involvement. The paper called the release of the footage a “proxy character assassination,” saying that Shamkhani’s past criticism of Rouhani’s handling of nuclear policy had fueled political resentment.
Pro-hardline activists echoed that view online, arguing that the leak followed Shamkhani’s recent comments implicating the previous administration in the delayed acknowledgment of the 2020 downing of a Ukrainian airliner by the Revolutionary Guards.
Figures close to Rouhani have denied any connection to the leak. A source told the news outlet Khabar Online that the act was “unethical and contrary to Islamic norms.”