BugSleep

BugSleep is a custom backdoor associated with the Iranian MOIS-linked threat actor MuddyWater, also tracked as Boggy Serpens, Seedworm, Static Kitten, Mango Sandstorm, and TA450. Public reporting places its deployment beginning in May 2024, with campaigns primarily targeting Israeli organizations, though related MuddyWater activity also affected entities in Saudi Arabia, Turkey, Azerbaijan, India, Portugal, Egypt, and broader MENA diplomatic, maritime, financial, telecommunications, government, aviation, and energy sectors. BugSleep has also been reported under the alias MuddyRot.

BugSleep is described as a backdoor used to execute commands and facilitate file transfers between compromised hosts and command-and-control servers. Reporting characterizes it as under active development, with multiple versions and rapid iteration. Sources describe it as Python-based in some reporting, while Check Point’s detailed July 2024 analysis identified it as a custom C/C++ backdoor; the content also notes a Phoenix delivery lineage that deployed BugSleep via malicious macro-enabled Office documents and a Phoenix injector.

Observed infection chains rely heavily on spear-phishing. MuddyWater used compromised organizational email accounts and trusted internal mailboxes to bypass filtering, then delivered malicious Office documents that instructed users to enable macros. When enabled, VBA macros silently dropped payloads and displayed decoy content. Related campaigns also abused Egnyte subdomains and other file-sharing services for payload delivery. In some campaigns, the same lure themes were reused across regions, with Saudi Arabia receiving Atera RMM payloads while Israeli targets received BugSleep.

Documented BugSleep functionality includes command execution, file exfiltration, writing file contents, interactive cmd execution via pipes until a terminate command, updating sleep/timeout values, stopping communications, and creating or removing persistence. It sends an initial victim identifier composed of computer name and username. Communications and configuration are encrypted with a byte-shift scheme, and C2 traffic uses a [size_of_data][data] format. BugSleep decrypts embedded configuration containing the C2 IP address and port.

Anti-analysis and persistence features are also documented. BugSleep uses repeated Sleep API calls to delay execution, creates mutexes including "PackageManager" and "DocumentUpdater," and commonly establishes persistence through a scheduled task named after the mutex with the comment "sample comment," configured to run every 30 minutes daily. One version enabled ProcessSignaturePolicy (MicrosoftSignedOnly) and ProcessDynamicCodePolicy (ProhibitDynamicCode) to hinder DLL injection and dynamic code or userland hooking by EDR.

A related loader was observed decrypting shellcode and injecting BugSleep in memory using WriteProcessMemory and CreateRemoteThread into processes including msedge.exe, opera.exe, chrome.exe, anydesk.exe, "Ondedrive.exe," and powershell.exe. Reporting also ties BugSleep to the Phoenix malware lineage, with forensic analysis showing shared development artifacts between Phoenix-delivered BugSleep and other MuddyWater implants. Additional reported indicators and characteristics include TCP port 443, the mutex "DocumentUpdater," identical string obfuscation logic across samples, and the novaservice.exe path shared with related malware tracks.