Really Muddy Waters

Refuting the Seedworm Attribution of Commodity MaaS — Companion analysis to the ClixFlare ClickFix Campaign Technical Report

1. Executive Summary

In March 2026, Symantec/Broadcom attributed malware found on U.S. and Canadian networks to Seedworm/MuddyWater, an Iranian MOIS cyber espionage unit.^[1] This attribution was echoed by Cisco Talos^[2], Check Point^[3], Rapid7^[4], CyberProof^[5], and JUMPSEC^[6], resulting in ClixFlare delivery infrastructure (zhivachkapro[.]com) and commodity MaaS payloads (CastleRAT, Tsundere Bot, Stagecomp/Darkcomp) being labeled "Iranian state capability" across seven vendor publications.

This document demonstrates that:

1. Every attributed IOC is commodity malware — independently identified by eSentire^[8], Recorded Future, vx-underground, ThreatDown, and Red Canary, with no APT attribution, spanning August 2025 through January 2026 — 7+ months before Symantec's attribution.
2. The sole technical link (code-signing certificates) is a purchasable criminal service — documented by Microsoft's Fox Tempest MSaaS research ($5k–$9k per certificate).^[9]
3. CastleRAT is Russian-developed MaaS (TAG-150) with Russian developer strings, CIS locale exclusion, and a multi-tenant panel. JUMPSEC explicitly assesses MuddyWater as a customer, not the developer.^[6]
4. The "Smokest" campaign JWT used as the primary attribution chain was found in commodity Amadey distribution via TopWebComics fake installers two months before it appeared on an Iranian-attributed server.
5. The real MuddyWater espionage operation (documented by Ctrl-Alt-Intel^[7]) uses custom Farsi C2 frameworks, Fortinet exploitation, and targets Middle Eastern government/aviation — bearing no resemblance to ClixFlare.
6. Iranian actors consuming commodity Russian malware is a documented historical pattern — the Handala group used Rhadamanthys with purchased certificates in 2023–2024.

2. Origin: Symantec/Broadcom (March 5, 2026)

The Seedworm attribution originates from Symantec/Broadcom (Threat Hunter Team), published March 5, 2026.^[1] Symantec found two malware families on the networks of a U.S. bank, airport, software company (Israeli operations), and a Canadian non-profit:

• "Dindoor" — a backdoor leveraging Deno to execute obfuscated JavaScript in memory. Signed with a certificate issued to "Amy Cherne."
• "Fakeset" — a Python backdoor. Signed with certificates issued to "Amy Cherne" and "Donald Gay." Downloaded from Backblaze B2 buckets (gitempire, elvenforest).

Symantec's attribution logic:

"The Donald Gay certificate has been used previously to sign malware linked to Seedworm… The Stagecomp and the Darkcomp malware have been linked to Seedworm by vendors including Google, Microsoft and Kaspersky. While this malware wasn't seen on the targeted networks, the use of the same certificates suggests the same actor — namely Seedworm — was behind the activity."^[1]

The entire attribution hangs on a single code-signing certificate ("Donald Gay") previously used to sign Stagecomp/Darkcomp, which Symantec claims were "linked to Seedworm by vendors including Google, Microsoft and Kaspersky." However, this prior attribution is uncitable from public sources. "Stagecomp" and "Darkcomp" are Symantec's own detection names (Trojan.Stagecomp, Trojan.Darkcomp). No Google/Mandiant, Microsoft, or Kaspersky publication attributing them to MuddyWater/Seedworm can be found predating this blog post. The documented MuddyWater malware catalog (POWERSTATS, SHARPSTATS, PowGoop, Mori, Small Sieve, STARWHALE, MuddyViper, Fooder, RustyWater, DCHSpy) does not include Stagecomp or Darkcomp. Every secondary source repeating this claim cites Symantec 2026 — the claim is circular.

If the prior Stagecomp/Darkcomp → Seedworm attribution cannot be independently verified, the entire chain collapses: the "Donald Gay" certificate signed multiple things, but the assertion that those things belong to Seedworm is an uncitable appeal to authority.

3. Pre-Attribution History: CastleRAT Was Commodity for 7+ Months

Before Symantec named anything "Dindoor" in March 2026, the same malware family had been independently discovered and documented as commodity criminal malware — with no APT attribution:

eSentire (August 2025) published "New Botnet Emerges from the Shadows: NightshadeC2,"^[8] documenting a botnet delivered via ClickFix initial access. The payload uses the window class name "IsabellaWine" — the same hardcoded MaaS template identifier JUMPSEC later found in CastleRAT builds. eSentire documented C and Python variants with HVNC, keylogging, clipboard harvesting, and browser credential theft. The Python variant was assessed as likely LLM-converted. No APT attribution.

Recorded Future (September 2025) began tracking the MaaS platform as TAG-150, identifying CastleRAT as a modular Russian-speaking criminal service.^[11]

vx-underground (January 18, 2026) independently discovered the same malware via a "TopWebComics" MSI. Researchers collaboratively reversed the chain: MSI → obfuscated JS → PS1 → Python (PyArmor) → JPEG steganography → CastleRAT payload. vx-underground named the JS component "Smokest Stealer" and called it "a very silly malware sample." No APT attribution.

ffforward/@TheAnalyst (January 19, 2026) corrected the naming: "Smokest might not be a good name, its likely just a campaign indicator." ffforward traced the broader delivery chain — Fake OBS → Donut → Amadey → Various MSI → PowerShell — with downloads of Petuhon.zip (Russian wordplay on "Python") and Smokest120.zip (Build 120) from 172.86.123[.]222.

The decoded JWT from the MSI reveals the full MaaS customer config:

{
  "campaignId": "75cbe18653d52372",
  "campaignName": "Smokest",
  "campaignUrl": "smokest",
  "configId": "8752e5472b9a3a80",
  "proxies": ["http://sharecodepro[.]com"],
  "userId": "bb47c0615477a877",
  "userNote": "topwebcomics",
  "iat": 1768623552,
  "exp": 2084199552
}

The malware was independently identified as commodity criminal tooling by eSentire^[8], Recorded Future^[11], vx-underground, ThreatDown^[10], and Red Canary — spanning August 2025 through January 2026 — before Symantec rebranded it "Dindoor" and attributed it to an Iranian state intelligence unit.^[1]

4. The Attribution Cascade

4.1 Echoes: Talos, Check Point, Ctrl-Alt-Intel, JUMPSEC, CyberProof

Cisco Talos (March 10, 2026) echoed Symantec's findings in a blog covering Middle East cyber activity,^[2] adding ClixFlare domains to the IOC list without independent attribution analysis:

hxxps://iuumfgrrnuhb[.]zhivachkapro[.]com/pobor
hxxp://terymar[.]com/install/Spf.ps1
Elvenforest[.]s3.us-east-005.backblazeb2[.]com
Uppdatefile[.]com
Gitempire[.]s3.us-east-005.backblazeb2[.]com
Moonzonet[.]com
Serialmenot[.]com

Check Point Research (March 11, 2026) published "Iranian MOIS Actors & the Cyber Crime Connection,"^[3] taking a more nuanced position: they explicitly acknowledge CastleLoader is MaaS and frame the relationship as MOIS actors using criminal tools. Their evidence is the same shared certificates, which they themselves note could indicate "common certificate sources or resale." Check Point also reveals that Tsundere Bot supports both Node.js and Deno runtimes.

Rapid7 (July 2026) published "Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware,"^[4] attributing a Chaos ransomware incident to MuddyWater as a "false flag masquerade." Their evidence: the attacker used Stagecomp (ms_upd.exe, 24857fe8...) to download Darkcomp (Game.exe, 1319d474...), both signed with the "Donald Gay" certificate, with C2 at moonzonet[.]com. These are the exact hashes from Symantec's IOC list. Rapid7 does not address the possibility that the certificate was purchased from a signing service.

Unattributed security researcher (January 2026) observed the same Stagecomp → Darkcomp chain independently — two months before Symantec's attribution: QuickAssist social engineering via dntix[.]com, initial binary ms_upd.exe connecting to moonzonet[.]com, dropping MessageBox.exe → Mozilla-fbbf0ab6.exe which contacted uploadfiler[.]com. The researcher described it as "interesting chain of activity" — no APT attribution.

Ctrl-Alt-Intel (March 4, 2026) published "MuddyWater Exposed: Inside an Iranian APT operation,"^[7] documenting an exposed VPS (157.20.182[.]49) in the Netherlands. Ctrl-Alt-Intel's MuddyWater attribution for the espionage operation on this server is credible, based on:

• Two independent infrastructure overlaps: IP 162.0.230[.]185 previously attributed to MuddyWater by Group-IB^[13]; IP 194.11.246[.]101 previously identified by ESET^[12] as a MuddyWater C2.
• Custom Farsi C2 frameworks: KeyC2 (Python/UDP) and PersianC2 (Python/HTTP with Farsi strings) — not commodity MaaS.
• Victimology consistent with MOIS priorities: Israeli healthcare, Jordanian government webmail, EgyptAir, BaSalam (Iranian domestic marketplace).
• Actual exfiltrated intelligence data: Egyptian passports, visa information, financial documents.

However, alongside these custom espionage tools, the server also contained reset.ps1 — Tsundere Bot / ChainShell (Node.js + ethers + ws, EtherHiding). This is a TAG-150 commodity tool sitting alongside custom espionage implants. Multiple explanations exist:

1. Customer: MuddyWater purchased a TAG-150 license and staged it for deployment.
2. Research/inspiration: Operators found publicly discussed samples on X and downloaded them to evaluate.
3. Shared infrastructure: Other actors on the same hosting may have left artifacts.

JUMPSEC (April 7, 2026) published "ChainShell: MuddyWater's Russian MaaS Link,"^[6] analyzing the same server. JUMPSEC's primary attribution chain is a JWT trace: Amy Cherne cert → MSI → serialmenot[.]com/mv2/<JWT> with campaignId: 75cbe18653d52372, campaignName: "Smokest", userID: bb47c0615477a877.

This JWT chain is significantly weakened by prior evidence neither JUMPSEC nor Ctrl-Alt-Intel addressed. The same JWT was extracted from a TopWebComics fake installer MSI in January 2026. The userNote is literally "topwebcomics". Build 120 was being distributed through Amadey (a commodity loader-as-a-service) — this is commodity financially-motivated distribution, not espionage tradecraft.

JUMPSEC's own conclusions support the commodity thesis:^[6]

• "We assess MuddyWater to be a customer of TAG-150, not its developer."
• "serialmenot[.]com C2 is multi-tenant. Other threat groups including LeakNet ransomware use the same Deno codebase with different campaign configs."
• "JavaScript RAT presence alone does not prove MuddyWater activity."
• ChainShell contains Russian developer strings ("вернул", "провайдер") and CIS locale exclusion.

JUMPSEC also repeats Symantec's uncitable claim that StageComp was "attributed by Google, Microsoft, and Kaspersky," and lists Google TAG, Microsoft TI, and Kaspersky GReAT in their acknowledgements — suggesting these may be private intelligence shares, not public publications.

Implication for ClixFlare: Ctrl-Alt-Intel^[7] demonstrates that real MuddyWater espionage (Fortinet exploitation, OWA spraying, custom Farsi C2s, Middle Eastern government targets) looks nothing like ClixFlare (WordPress ClickFix, Five Eyes consumers, commodity MaaS payloads).

CyberProof (July 2026) published "Iranian APT Seedworm Targets Global Organizations via Microsoft Teams,"^[5] attributing a Teams intrusion to Seedworm. CyberProof's attribution rests entirely on matching artifacts against Talos/Symantec IOC lists — circular inheritance.

4.2 The Certificate Problem

The code-signing certificates remain the primary technical link. Microsoft published "Exposing Fox Tempest: A malware-signing service operation,"^[9] documenting a Malware-Signing-as-a-Service (MSaaS) operation (signspace[.]cloud) selling certificates for $5,000–$9,000 USD. Fox Tempest's customers include ransomware affiliates linked to INC, Qilin, Akira, and Rhysida.

5. Counter-Evidence Summary

Every "Seedworm" IOC published by Symantec^[1] and echoed by Talos^[2] has been independently identified as commodity cybercrime:

6. Attribution Cascade Timeline

7. Reductio ad Absurdum

If the combined vendor attribution is taken at face value, a single MOIS subordinate element (MuddyWater) would simultaneously be:

1. Operating ClixFlare — a mass WordPress ClickFix IAB platform targeting Five Eyes consumers
2. Developing and selling CastleRAT — a commodity MaaS infostealer sold via panel
3. Developing and selling Tsundere Bot — a separate Node.js MaaS botnet used by Russian cybercriminals
4. Purchasing code-signing certificates from the same MSaaS vendors used by Chaos, INC, Qilin, and Akira affiliates
5. Operating as a Chaos RaaS affiliate — deploying ransomware against U.S. companies^[4]
6. Operating as a Qilin RaaS affiliate — attacking an Israeli hospital^[3]
7. Running Teams social engineering under "Sarah Wilson" to deliver CastleRAT^[5]
8. Maintaining actual espionage operations against Middle Eastern government targets

The simpler explanation: multiple unrelated criminal actors purchased the same commodity malware, the same commodity signing certificates, and in some cases obtained initial access through the same commodity IAB (ClixFlare). The "Donald Gay" certificate is not a fingerprint — it is a receipt.

8. Historical Precedent: Iranian Actors as Commodity MaaS Customers

The pattern of Iranian state-affiliated actors consuming Russian commodity malware and purchasing code-signing certificates predates the CastleRAT/ClixFlare attribution by years.

8.1 Handala Group — Rhadamanthys + Purchased Certificates (2023–2026)

The Handala group (MOIS-linked Iranian hacktivists) conducted destructive wiper operations against Israeli targets using commodity Russian malware for intelligence collection, followed by custom destructive tools.

F5UPDATER Campaign (2023):

1. F5UPDATER.exe — signed with "Skytec Global Ltd" certificate (SSL.com, 2023-12-17, subsequently revoked).
2. → Handala.exe runs first — deploys Rhadamanthys infostealer via Asgard Protector loader (AV enumeration, binary fragment reassembly via Naples.pif, process hollowing via WerFault.exe).
3. → Hatef.exe runs second — the actual wiper (ConfirmDeleteFiles).

INCD Impersonation (April 2024): Handala impersonated Israel's National Cyber Directorate via incd[.]org[.]il, delivering encrypted ZIP → WSF → Asgard Protector → Rhadamanthys again.

8.2 Pattern Summary

The consistent pattern: Iranian actors purchase commodity Russian malware for collection and purchase code-signing certificates from criminal MSaaS vendors. Their custom tools (wipers, Farsi C2 frameworks) are separate and distinct. When vendors attribute the commodity tools to the Iranian actors as if they developed them, they are conflating consumption with ownership.

9. Confidence Assessment

HIGH — The Seedworm attribution is incorrect as stated. Every IOC has been independently identified as commodity malware by other vendors, and the sole technical link (code-signing certificates) is a documented commodity service.

HIGH — zhivachkapro[.]com is ClixFlare infrastructure.

MODERATE — Seedworm may have used ClixFlare-delivered access as an entry point at specific targets, but the malware itself (CastleRAT, Tsundere Bot, Stagecomp/Darkcomp) is commodity MaaS available to any buyer.

10. Cross-Vendor IOC Overlap

All hashes and domains below have been attributed to Seedworm/MuddyWater by one or more vendors. We assess these are commodity MaaS artifacts, not APT-exclusive tooling.

10.1 Cross-Vendor Hash Overlap

10.2 Cross-Vendor Domain/Infrastructure Overlap

10.3 Code-Signing Certificates

11. Per-Vendor IOC Lists

11.1 Symantec/Broadcom^[1] (March 5, 2026)

Trojan.Dindoor (CastleRAT):

Trojan.Fakeset (CastleLoader):

Trojan.Stagecomp / Trojan.Darkcomp:

Symantec domains:

11.2 Talos^[2] (March 10, 2026)

11.3 ThreatDown^[10] (March 10, 2026 — no APT attribution)

11.4 Rapid7^[4] (July 2026 — Chaos RaaS)

11.5 Red Canary (January 2026 — no APT attribution)

11.6 CyberProof^[5] (July 2026 — attribution cascaded from Talos)

12. Conclusion

The Seedworm/MuddyWater attribution of CastleRAT, Tsundere Bot, and ClixFlare infrastructure represents a systemic failure in threat intelligence methodology — not a failure of any single vendor, but the cumulative effect of an attribution cascade where each publication reinforced the last without independent verification of the foundational claim.

The sequence is clear: Symantec attributed commodity malware to an Iranian state unit based on a shared code-signing certificate and an uncitable prior attribution. Talos echoed it. Check Point, Rapid7, CyberProof, and JUMPSEC each inherited the attribution through IOC matching, adding their own incidents to the same pile without questioning the base layer. By July 2026, seven vendor publications had collectively transformed a Russian criminal MaaS platform into "Iranian state capability" — while five independent observers who encountered the same tooling earlier saw nothing but commodity cybercrime.

The irony is that JUMPSEC — whose analysis is the most technically rigorous — explicitly reached the correct conclusion: MuddyWater is a customer of TAG-150, not its developer.^[6] Yet even this finding was framed as "MuddyWater's Russian MaaS Link" rather than what it actually demonstrates: that the TAG-150 ecosystem is a multi-tenant criminal service whose customer list tells you nothing about who operates it.

The practical consequences are significant. Defenders who ingest Seedworm IOC feeds now have commodity MaaS infrastructure mapped to an Iranian state actor, generating false positives whenever any TAG-150 customer — LeakNet ransomware, Chaos RaaS affiliates, random fake-installer campaigns — triggers the same indicators. The attribution has not improved anyone's security posture; it has degraded it.

The correct framing: zhivachkapro[.]com is ClixFlare — a commodity initial access broker. CastleRAT and Tsundere Bot are TAG-150 — a Russian criminal MaaS platform. The "Amy Cherne" and "Donald Gay" certificates are receipts from a signing service, not fingerprints of a state actor. MuddyWater may well be one of many customers who purchased access through these services — but the services themselves, and the infrastructure that delivers them, are not Iranian state operations.

References

1. Symantec/Broadcom — "Seedworm: Iranian Hackers Target Telecoms, IT, and Utilities" (March 5, 2026). https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us
2. Cisco Talos — "Talos Developing Situation in the Middle East" (March 10, 2026). https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east/
3. Check Point Research — "Iranian MOIS Actors & the Cyber Crime Connection" (March 11, 2026). https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/
4. Rapid7 — "Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware" (July 2026). https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/
5. CyberProof — "Iranian APT Seedworm Targets Global Organizations via Microsoft Teams" (July 2026). https://www.cyberproof.com/blog/iranian-apt-seedworm-targets-global-organizations-via-microsoft-teams/
6. JUMPSEC — "ChainShell: MuddyWater's Russian Criminal Infrastructure" (April 7, 2026). https://www.jumpsec.com/guides/chainshell-muddywater-russian-criminal-infrastructure/
7. Ctrl-Alt-Intel — "MuddyWater Exposed: Inside an Iranian APT operation" (March 4, 2026). https://ctrlaltintel.com/research/MuddyWater/
8. eSentire — "New Botnet Emerges from the Shadows: NightshadeC2" (August 2025). https://www.esentire.com/blog/new-botnet-emerges-from-the-shadows-nightshadec2
9. Microsoft — "Exposing Fox Tempest: A malware-signing service operation" (May 19, 2026).
10. ThreatDown/Malwarebytes — CastleRAT analysis (March 10, 2026).
11. Recorded Future — TAG-150 tracking (September 2025).
12. ESET — "MuddyWater: Snakes by the riverbank" (December 2025).
13. Group-IB — "Operation Olalampo: Inside MuddyWater's Latest Campaign" (February 2026).