Really Muddy Waters

Refuting the Seedworm Attribution of Commodity MaaS — Companion analysis to the ClixFlare ClickFix Campaign Technical Report

1. Executive Summary

In March 2026, Symantec/Broadcom attributed malware found on U.S. and Canadian networks to Seedworm/MuddyWater, an Iranian MOIS cyber espionage unit.^[1] This attribution was echoed by Cisco Talos^[2], Check Point^[3], Rapid7^[4], CyberProof^[5], JUMPSEC^[6], and a second Symantec article^[15], resulting in ClixFlare delivery infrastructure (zhivachkapro[.]com) and commodity MaaS payloads (CastleRAT, Tsundere Bot, Stagecomp/Darkcomp) being labeled "Iranian state capability" across eight vendor publications.

This document demonstrates that:

1. Every attributed IOC is commodity malware — independently identified by eSentire^[8], Recorded Future^[11], vx-underground, ThreatDown^[10], Blackpoint Cyber^[14], and an unattributed researcher, with no APT attribution, spanning August 2025 through March 2026 — with commodity use documented both before and after Symantec's attribution.
2. The sole technical link (code-signing certificates) is a purchasable criminal service — documented by Microsoft's Fox Tempest MSaaS research ($5k–$9k per certificate).^[9]
3. CastleRAT is Russian-developed MaaS (TAG-150) with Russian developer strings, CIS locale exclusion, and a multi-tenant panel. JUMPSEC explicitly assesses MuddyWater as a customer, not the developer.^[6]
4. The "Smokest" campaign JWT used as the primary attribution chain was found in commodity Amadey distribution via TopWebComics fake installers two months before it appeared on an Iranian-attributed server.
5. The real MuddyWater espionage operation (documented by Ctrl-Alt-Intel^[7] and Group-IB^[13]) uses custom malware (GhostFetch, CHAR, KeyC2, PersianC2), Persian-language artifacts, and targets Middle Eastern government/aviation — with zero custom-tool overlap with Symantec's "Seedworm" indicators. The sole shared artifact (lpu.exe) is a commodity credential harvester also served from terymar[.]com in walk-in QuickAssist attacks.
6. Iranian actors consuming commodity Russian malware is a documented historical pattern — the Handala group used Rhadamanthys with purchased certificates in 2023–2024.

2. Origin: Symantec/Broadcom (March 5, 2026)

The Seedworm attribution originates from Symantec/Broadcom (Threat Hunter Team), published March 5, 2026.^[1] Symantec found two malware families on the networks of a U.S. bank, airport, software company (Israeli operations), and a Canadian non-profit:

• "Dindoor" — a backdoor leveraging Deno to execute obfuscated JavaScript in memory. Signed with a certificate issued to "Amy Cherne."
• "Fakeset" — a Python backdoor. Signed with certificates issued to "Amy Cherne" and "Donald Gay." Downloaded from Backblaze B2 buckets (gitempire, elvenforest).

Symantec's attribution logic:

"The Donald Gay certificate has been used previously to sign malware linked to Seedworm… The Stagecomp and the Darkcomp malware have been linked to Seedworm by vendors including Google, Microsoft and Kaspersky. While this malware wasn't seen on the targeted networks, the use of the same certificates suggests the same actor — namely Seedworm — was behind the activity."^[1]

The entire attribution hangs on a single code-signing certificate ("Donald Gay") previously used to sign Stagecomp/Darkcomp, which Symantec claims were "linked to Seedworm by vendors including Google, Microsoft and Kaspersky." However, this prior attribution is uncitable from public sources. "Stagecomp" and "Darkcomp" are Symantec's own detection names (Trojan.Stagecomp, Trojan.Darkcomp). No Google/Mandiant, Microsoft, or Kaspersky publication attributing them to MuddyWater/Seedworm can be found predating this blog post. The documented MuddyWater malware catalog (POWERSTATS, SHARPSTATS, PowGoop, Mori, Small Sieve, STARWHALE, MuddyViper, Fooder, RustyWater, DCHSpy) does not include Stagecomp or Darkcomp. Every secondary source repeating this claim cites Symantec 2026 — the claim is circular.

If the prior Stagecomp/Darkcomp → Seedworm attribution cannot be independently verified, the entire chain collapses: the "Donald Gay" certificate signed multiple things, but the assertion that those things belong to Seedworm is an uncitable appeal to authority.

3. Commodity Provenance: Before, During, and After Attribution

The same malware family was independently discovered and documented as commodity criminal malware — with no APT attribution — both before and after Symantec's March 2026 attribution event.

3.1 Pre-Attribution (August 2025 – January 2026)

eSentire (August 2025) published "New Botnet Emerges from the Shadows: NightshadeC2,"^[8] documenting a botnet delivered via ClickFix initial access. The payload uses the window class name "IsabellaWine" — the same hardcoded MaaS template identifier JUMPSEC later found in CastleRAT builds. eSentire documented C and Python variants with HVNC, keylogging, clipboard harvesting, and browser credential theft. The Python variant was assessed as likely LLM-converted. No APT attribution.

Recorded Future (September 2025) began tracking the MaaS platform as TAG-150, identifying CastleRAT as a modular Russian-speaking criminal service.^[11]

vx-underground (January 18, 2026) independently discovered the same malware via a "TopWebComics" MSI. Researchers collaboratively reversed the chain: MSI → obfuscated JS → PS1 → Python (PyArmor) → JPEG steganography → CastleRAT payload. vx-underground named the JS component "Smokest Stealer" and called it "a very silly malware sample." No APT attribution.

ffforward/@TheAnalyst (January 19, 2026) corrected the naming: "Smokest might not be a good name, its likely just a campaign indicator." ffforward traced the broader delivery chain — Fake OBS → Donut → Amadey → Various MSI → PowerShell — with downloads of Petuhon.zip (Russian wordplay on "Python") and Smokest120.zip (Build 120) from 172.86.123[.]222.

The decoded JWT from the MSI reveals the full MaaS customer config:

{
  "campaignId": "75cbe18653d52372",
  "campaignName": "Smokest",
  "campaignUrl": "smokest",
  "configId": "8752e5472b9a3a80",
  "proxies": ["http://sharecodepro[.]com"],
  "userId": "bb47c0615477a877",
  "userNote": "topwebcomics",
  "iat": 1768623552,
  "exp": 2084199552
}

3.2 Post-Attribution: Commodity Use Continued

Blackpoint Cyber (March 18, 2026) published "A Match Made in Malware: Quick Assist,"^[14] documenting a QuickAssist social engineering attack that downloaded Serial.msi and lpu.dll from terymar[.]com, then fetched Spf.ps1 via PowerShell cradle from the same domain — installing Node.js 18.17.0 and executing the Tsundere Bot payload. The process tree:

QuickAssist → cmd → curl (Serial.msi from terymar[.]com)
  → bitsadmin (lpu.dll from terymar[.]com)
  → PowerShell cradle (Spf.ps1 from terymar[.]com)
    → node.exe (Node.js 18.17.0 installed silently)
    → rundll32 (lpu.dll .main export)

This was published 8 days after Talos labeled the same terymar[.]com domain as a "Seedworm" IOC.^[2] Blackpoint treated the identical infrastructure as commodity QuickAssist social engineering. No APT attribution. The Spf.ps1 script (29b777e7...) was confirmed in-the-wild on terymar[.]com/install/Spf.ps1 as late as April 2, 2026.

The malware was independently identified as commodity criminal tooling by six observers — eSentire^[8], Recorded Future^[11], vx-underground, ThreatDown^[10], an unattributed researcher, and Blackpoint Cyber^[14] — spanning August 2025 through March 2026, with commodity use documented both before and after Symantec's attribution event.^[1] Blackpoint's post-attribution observation is particularly significant: the same "Seedworm" IOC was concurrently serving walk-in commodity attacks.

4. The Attribution Cascade

4.1 Echoes: Talos, Check Point, Ctrl-Alt-Intel, JUMPSEC, CyberProof

Cisco Talos (March 10, 2026) echoed Symantec's findings in a blog covering Middle East cyber activity,^[2] republishing the complete Symantec hash set (all Dindoor, Fakeset, Darkcomp, and Stagecomp hashes verbatim) plus additional ClixFlare domains, without independent attribution analysis:

hxxps://iuumfgrrnuhb[.]zhivachkapro[.]com/pobor
hxxp://terymar[.]com/install/Spf.ps1
Elvenforest[.]s3.us-east-005.backblazeb2[.]com
Uppdatefile[.]com
Gitempire[.]s3.us-east-005.backblazeb2[.]com
Moonzonet[.]com
Serialmenot[.]com

Check Point Research (March 11, 2026) published "Iranian MOIS Actors & the Cyber Crime Connection,"^[3] taking a more nuanced position: they explicitly acknowledge CastleLoader is MaaS and frame the relationship as MOIS actors using criminal tools. Their evidence is the same shared certificates, which they themselves note could indicate "common certificate sources or resale." Check Point also reveals that Tsundere Bot supports both Node.js and Deno runtimes.

Rapid7 (July 2026) published "Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware,"^[4] attributing a Chaos ransomware incident to MuddyWater as a "false flag masquerade." Their evidence: the attacker used Stagecomp (ms_upd.exe, 24857fe8...) to download Darkcomp (Game.exe, 1319d474...), both signed with the "Donald Gay" certificate, with C2 at moonzonet[.]com. These are the exact hashes from Symantec's IOC list. Rapid7 does not address the possibility that the certificate was purchased from a signing service.

Unattributed security researcher (January 2026) observed the same Stagecomp → Darkcomp chain independently — two months before Symantec's attribution: QuickAssist social engineering via dntix[.]com, initial binary ms_upd.exe connecting to moonzonet[.]com, dropping MessageBox.exe → Mozilla-fbbf0ab6.exe which contacted uploadfiler[.]com. The researcher described it as "interesting chain of activity" — no APT attribution.

Ctrl-Alt-Intel (March 4, 2026) published "MuddyWater Exposed: Inside an Iranian APT operation,"^[7] documenting an exposed VPS (157.20.182[.]49) in the Netherlands. Ctrl-Alt-Intel's MuddyWater attribution for the espionage operation on this server is credible, based on:

• Two independent infrastructure overlaps: IP 162.0.230[.]185 previously attributed to MuddyWater by Group-IB^[13]; IP 194.11.246[.]101 previously identified by ESET^[12] as a MuddyWater C2.
• Custom Farsi C2 frameworks: KeyC2 (Python/UDP) and PersianC2 (Python/HTTP with Farsi strings) — not commodity MaaS.
• Victimology consistent with MOIS priorities: Israeli healthcare, Jordanian government webmail, EgyptAir, BaSalam (Iranian domestic marketplace).
• Actual exfiltrated intelligence data: Egyptian passports, visa information, financial documents.

However, alongside these custom espionage tools, the server also contained reset.ps1 — Tsundere Bot / ChainShell (Node.js + ethers + ws, EtherHiding). This is a TAG-150 commodity tool sitting alongside custom espionage implants. Multiple explanations exist:

1. Customer: MuddyWater purchased a TAG-150 license and staged it for deployment.
2. Research/inspiration: Operators found publicly discussed samples on X and downloaded them to evaluate.
3. Shared infrastructure: Other actors on the same hosting may have left artifacts.

JUMPSEC (April 7, 2026) published "ChainShell: MuddyWater's Russian MaaS Link,"^[6] analyzing the same server. JUMPSEC's primary attribution chain is a JWT trace: Amy Cherne cert → MSI → serialmenot[.]com/mv2/<JWT> with campaignId: 75cbe18653d52372, campaignName: "Smokest", userID: bb47c0615477a877.

This JWT chain is significantly weakened by prior evidence neither JUMPSEC nor Ctrl-Alt-Intel addressed. The same JWT was extracted from a TopWebComics fake installer MSI in January 2026. The userNote is literally "topwebcomics". Build 120 was being distributed through Amadey (a commodity loader-as-a-service) — this is commodity financially-motivated distribution, not espionage tradecraft.

JUMPSEC's own conclusions support the commodity thesis:^[6]

• "We assess MuddyWater to be a customer of TAG-150, not its developer."
• "serialmenot[.]com C2 is multi-tenant. Other threat groups including LeakNet ransomware use the same Deno codebase with different campaign configs."
• "JavaScript RAT presence alone does not prove MuddyWater activity."
• ChainShell contains Russian developer strings ("вернул", "провайдер") and CIS locale exclusion.

JUMPSEC also repeats Symantec's uncitable claim that StageComp was "attributed by Google, Microsoft, and Kaspersky," and lists Google TAG, Microsoft TI, and Kaspersky GReAT in their acknowledgements — suggesting these may be private intelligence shares, not public publications.

Group-IB (February 2026) independently documented real MuddyWater operations in "Operation Olalampo,"^[13] providing the most detailed public view of MuddyWater's actual tradecraft. The campaign, targeting MENA government and critical infrastructure from January 2026, used:

• Custom malware: GhostFetch (.NET downloader), GhostBackDoor (AES-encrypted C2 with French-named API endpoints), HTTP_VIP (Flask/Python C2 deploying AnyDesk), and CHAR (Rust backdoor controlled via Telegram bot).
• Custom C2 infrastructure: Werkzeug/Python backends on dedicated servers (promoverse[.]org, codefusiontech[.]org, miniquest[.]org), with AI-generated decoy websites and Apache reverse-proxy layering.
• Persian keyboard artifacts: Command history contains "فئعط" — the Persian keyboard mapping of "tmux".
• Consistent tooling across campaigns: FMAPP.dll (reverse SOCKS5 proxy), cobe-notes.txt (custom browser infostealer output), BlackBeard/CHAR shared PDB paths — all linking back to prior documented MuddyWater operations.
• AI-assisted development: CHAR backdoor contains emoji debug strings consistent with Gemini AI code generation (corroborating Google TAG's assessment).

Implication for ClixFlare: Ctrl-Alt-Intel^[7] and Group-IB^[13] independently document what real MuddyWater operations look like. The contrast with Symantec's "Seedworm" attribution is stark:

CyberProof (July 2026) published "Iranian APT Seedworm Targets Global Organizations via Microsoft Teams,"^[5] attributing a Teams intrusion to Seedworm. CyberProof's attribution rests entirely on matching artifacts against Talos/Symantec IOC lists — circular inheritance.

4.1a Symantec's Second Seedworm Article (May 12, 2026)

Symantec published a follow-up, "Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker,"^[15] describing intrusions at nine organizations across four continents. The article claims continuity with Group-IB's Operation Olalampo^[13] via two links:

1. fmapp.exe / fmapp.dll sideloading: Symantec states "The same fmapp.exe / fmapp.dll pairing has been described in prior Seedworm reporting by Group-IB." However, Group-IB's fmapp.dll (SHA-1: 62ED16701A14CE26314F2436D9532FE606C15407, SHA-256: 3fa148e2d3fb86cecc15c276c5329496beba9aba14a6024b561efabf2e4e68af) is a reverse SOCKS5 proxy. Symantec's fmapp.dll (SHA-256: c6182fd0...) contains ChromElevator — a public GitHub tool. These are different payloads sharing only the sideloading host binary. fmapp.exe (Fortemedia audio driver) is a well-known DLL sideloading target — any operator can use it. This was trivially verifiable: Group-IB's public report contains the SHA-1 hash in the attribution section; pasting it into VirusTotal — where it has been indexed since February 15, 2026 — immediately returns the SHA-256 and confirms it is a different binary. Symantec either did not perform this basic check or disregarded the result.
2. Credential harvester d5879598...: This hash (SHA-1: 2f5166086da5a57d7e59a767a54ed6fe9a6db444, listed as lpu.exe) is present in Group-IB's public IOC appendix — so Symantec's overlap claim is technically correct for this one artifact. However, the file appears only in the IOC list, with no analysis or discussion in the report narrative — and Group-IB lists it as lpu.exe, while every in-the-wild observation uses lpu.dll, suggesting Group-IB catalogued it from server artifacts without close analysis. Symantec's own hedge — "the public report did not pin down exactly what the binary does" — confirms the file was never analyzed in context. VirusTotal's In-The-Wild data shows this file served from at least three unrelated staging domains:

   Date	URL	Detections
   2026-02-05	terymar[.]com/install/lpu.dll	0/94
   2026-02-24	wa.opt7dev[.]com/asset/cv.msi	0/94
   2026-03-03	wa.opt7dev[.]com/asset/lpu.dll	0/95
   2026-03-12	steuerberaterbarcelona[.]com/install/lpu.dll	13/96

   The wa.opt7dev[.]com server also staged cv.msi (a fake resume/CV installer) on the same /asset/ path — this is a Tsundere Bot deployment node. A credential harvester staged alongside fake-CV social engineering lures, served from a German tax accountant's website in Barcelona, a WordPress development domain, and the same terymar[.]com that Blackpoint documented in commodity QuickAssist attacks^[14] is, by definition, commodity tooling distributed across compromised infrastructure. Its presence on a MuddyWater server proves consumption, not ownership.

The credential harvester d587959841a763669279ad831b8f0379f6a7b037dffc19deab5d41f37f8b5ffc is also known as lpu.dll on VirusTotal — the same filename Blackpoint Cyber documented at terymar[.]com/install/lpu[.]dll^[14] in their commodity QuickAssist social engineering chain, and the same terymar[.]com that Talos labeled a "Seedworm domain"^[2] eight days before Blackpoint saw it serving walk-in commodity attacks.

Symantec's own attack chain description is revealing: "The initial infection vector used by the attackers in this incident is unknown. [...] node.exe, the Node.js runtime, appeared as an ancestor of cmd.exe, suggesting that a Node.js script was already running on the host. [...] How node.exe came to be on the host is unknown." This is the exact post-exploitation state that Blackpoint Cyber documented two months earlier^[14]: QuickAssist social engineering → silent Node.js 18.17.0 install → Node.js drives PowerShell → payloads fetched from terymar[.]com. Blackpoint published on March 18. Symantec published on May 12. The answer to "How node.exe came to be on the host is unknown" was already public — it was a commodity QuickAssist scam.

The tradecraft in this article — ChromElevator (public GitHub tool), SAM hive theft via reg save, credential phishing via CredUIPromptForWindowsCredentials, Kerberos TGT extraction, data exfiltration via sendit[.]sh (a public file-transfer service) — is indistinguishable from a standard ransomware pre-deployment playbook. Nothing in the described tooling or techniques is espionage-specific.

4.2 The Certificate Problem

The code-signing certificates remain the primary technical link. Microsoft published "Exposing Fox Tempest: A malware-signing service operation,"^[9] documenting a Malware-Signing-as-a-Service (MSaaS) operation (signspace[.]cloud) selling certificates for $5,000–$9,000 USD. Fox Tempest's customers include ransomware affiliates linked to INC, Qilin, Akira, and Rhysida.

5. Counter-Evidence Summary

Every "Seedworm" IOC published by Symantec^[1] and echoed by Talos^[2] has been independently identified as commodity cybercrime:

6. Attribution Cascade Timeline

7. Reductio ad Absurdum

If the combined vendor attribution is taken at face value, a single MOIS subordinate element (MuddyWater) would simultaneously be:

1. Operating ClixFlare — a mass WordPress ClickFix IAB platform targeting Five Eyes consumers
2. Developing and selling CastleRAT — a commodity MaaS infostealer sold via panel
3. Developing and selling Tsundere Bot — a separate Node.js MaaS botnet used by Russian cybercriminals
4. Purchasing code-signing certificates from the same MSaaS vendors used by Chaos, INC, Qilin, and Akira affiliates
5. Operating as a Chaos RaaS affiliate — deploying ransomware against U.S. companies^[4]
6. Operating as a Qilin RaaS affiliate — attacking an Israeli hospital^[3]
7. Running Teams social engineering under "Sarah Wilson" to deliver CastleRAT^[5]
8. Maintaining actual espionage operations against Middle Eastern government targets

The simpler explanation: multiple unrelated criminal actors purchased the same commodity malware, the same commodity signing certificates, and in some cases obtained initial access through the same commodity IAB (ClixFlare). The "Donald Gay" certificate is not a fingerprint — it is a receipt.

8. Historical Precedent: Iranian Actors as Commodity MaaS Customers

The pattern of Iranian state-affiliated actors consuming Russian commodity malware and purchasing code-signing certificates predates the CastleRAT/ClixFlare attribution by years.

8.1 Handala Group — Rhadamanthys + Purchased Certificates (2023–2026)

The Handala group (MOIS-linked Iranian hacktivists) conducted destructive wiper operations against Israeli targets using commodity Russian malware for intelligence collection, followed by custom destructive tools.

F5UPDATER Campaign (2023):

1. F5UPDATER.exe — signed with "Skytec Global Ltd" certificate (SSL.com, 2023-12-17, subsequently revoked).
2. → Handala.exe runs first — deploys Rhadamanthys infostealer via Asgard Protector loader (AV enumeration, binary fragment reassembly via Naples.pif, process hollowing via WerFault.exe).
3. → Hatef.exe runs second — the actual wiper (ConfirmDeleteFiles).

INCD Impersonation (April 2024): Handala impersonated Israel's National Cyber Directorate via incd[.]org[.]il, delivering encrypted ZIP → WSF → Asgard Protector → Rhadamanthys again.

8.2 Pattern Summary

The consistent pattern: Iranian actors purchase commodity Russian malware for collection and purchase code-signing certificates from criminal MSaaS vendors. Their custom tools (wipers, Farsi C2 frameworks) are separate and distinct. When vendors attribute the commodity tools to the Iranian actors as if they developed them, they are conflating consumption with ownership.

9. Confidence Assessment

HIGH — The Seedworm attribution is incorrect as stated. Every IOC has been independently identified as commodity malware by other vendors, and the sole technical link (code-signing certificates) is a documented commodity service.

HIGH — zhivachkapro[.]com is ClixFlare infrastructure.

MODERATE — Seedworm may have used ClixFlare-delivered access as an entry point at specific targets, but the malware itself (CastleRAT, Tsundere Bot, Stagecomp/Darkcomp) is commodity MaaS available to any buyer.

10. Cross-Vendor IOC Overlap

All hashes and domains below have been attributed to Seedworm/MuddyWater by one or more vendors. We assess these are commodity MaaS artifacts, not APT-exclusive tooling.

10.1 Cross-Vendor Hash Overlap

10.2 Cross-Vendor Domain/Infrastructure Overlap

10.3 Code-Signing Certificates

11. Per-Vendor IOC Lists

11.1 Symantec/Broadcom^[1] (March 5, 2026)

Trojan.Dindoor (CastleRAT):

Trojan.Fakeset (CastleLoader):

Trojan.Stagecomp / Trojan.Darkcomp:

Symantec domains:

11.2 Talos^[2] (March 10, 2026)

Talos republished the complete Symantec hash set verbatim — all 10 Dindoor, 11 Fakeset, 2 Darkcomp, and 2 Stagecomp hashes (see Section 11.1) — under the label "Seedworm." The following are IOCs unique to or notable in the Talos publication:

11.2a Blackpoint Cyber^[14] (March 18, 2026 — no APT attribution)

11.3 ThreatDown^[10] (March 10, 2026 — no APT attribution)

11.4 Rapid7^[4] (July 2026 — Chaos RaaS)

11.5 Unattributed Researcher (January 2026 — no APT attribution)

11.6 CyberProof^[5] (July 2026 — attribution cascaded from Talos)

12. Conclusion

The Seedworm/MuddyWater attribution of CastleRAT, Tsundere Bot, and ClixFlare infrastructure represents a systemic failure in threat intelligence methodology — not a failure of any single vendor, but the cumulative effect of an attribution cascade where each publication reinforced the last without independent verification of the foundational claim.

The sequence is clear: Symantec attributed commodity malware to an Iranian state unit based on a shared code-signing certificate and an uncitable prior attribution. Talos echoed it — republishing the complete Symantec hash set verbatim and adding terymar[.]com to the "Seedworm" IOC list. Check Point, Rapid7, CyberProof, and JUMPSEC each inherited the attribution through IOC matching, adding their own incidents to the same pile without questioning the base layer. Symantec then published a second article^[15] claiming continuity with Group-IB's Operation Olalampo via a shared sideloading filename (fmapp.exe) — but the actual DLL payloads are different binaries, and the credential harvester they cite (d5879598...) is lpu.dll, the same file Blackpoint documented from terymar[.]com in their commodity QuickAssist chain. By July 2026, eight vendor publications had collectively transformed a Russian criminal MaaS platform into "Iranian state capability" — while six independent observers who encountered the same tooling saw nothing but commodity cybercrime.

The Blackpoint Cyber publication is particularly instructive. Eight days after Talos labeled terymar[.]com a "Seedworm domain," Blackpoint documented the exact same domain delivering the exact same Tsundere Bot payload to a commodity QuickAssist social engineering victim^[14] — and saw no reason to attribute it to any state actor. The "Seedworm" IOC was concurrently serving walk-in commodity attacks. This is not ambiguous: it is the kind of evidence that should have prompted every downstream vendor to revisit the foundational attribution.

The irony is that JUMPSEC — whose analysis is the most technically rigorous — explicitly reached the correct conclusion: MuddyWater is a customer of TAG-150, not its developer.^[6] Yet even this finding was framed as "MuddyWater's Russian MaaS Link" rather than what it actually demonstrates: that the TAG-150 ecosystem is a multi-tenant criminal service whose customer list tells you nothing about who operates it.

The practical consequences are significant. Defenders who ingest Seedworm IOC feeds now have commodity MaaS infrastructure mapped to an Iranian state actor, generating false positives whenever any TAG-150 customer — LeakNet ransomware, Chaos RaaS affiliates, QuickAssist tech support scammers, random fake-installer campaigns — triggers the same indicators. The contamination has escaped vendor reports entirely: on MalwareBazaar and VirusTotal, community members tag commodity samples #muddywater by citing vendor reports that cite other vendor reports. YARA rules encode the attribution as fact. The attribution has not improved anyone's security posture; it has degraded it.

The correct framing: zhivachkapro[.]com is ClixFlare — a commodity initial access broker. CastleRAT and Tsundere Bot are TAG-150 — a Russian criminal MaaS platform. The "Amy Cherne" and "Donald Gay" certificates are receipts from a signing service, not fingerprints of a state actor. MuddyWater may well be one of many customers who purchased access through these services — but the services themselves, and the infrastructure that delivers them, are not Iranian state operations.

References

1. Symantec/Broadcom — "Seedworm: Iranian Hackers Target Telecoms, IT, and Utilities" (March 5, 2026). https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us
2. Cisco Talos — "Talos Developing Situation in the Middle East" (March 10, 2026). https://blog.talosintelligence.com/talos-developing-situation-in-the-middle-east/
3. Check Point Research — "Iranian MOIS Actors & the Cyber Crime Connection" (March 11, 2026). https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/
4. Rapid7 — "Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware" (July 2026). https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/
5. CyberProof — "Iranian APT Seedworm Targets Global Organizations via Microsoft Teams" (July 2026). https://www.cyberproof.com/blog/iranian-apt-seedworm-targets-global-organizations-via-microsoft-teams/
6. JUMPSEC — "ChainShell: MuddyWater's Russian Criminal Infrastructure" (April 7, 2026). https://www.jumpsec.com/guides/chainshell-muddywater-russian-criminal-infrastructure/
7. Ctrl-Alt-Intel — "MuddyWater Exposed: Inside an Iranian APT operation" (March 4, 2026). https://ctrlaltintel.com/research/MuddyWater/
8. eSentire — "New Botnet Emerges from the Shadows: NightshadeC2" (August 2025). https://www.esentire.com/blog/new-botnet-emerges-from-the-shadows-nightshadec2
9. Microsoft — "Exposing Fox Tempest: A malware-signing service operation" (May 19, 2026). https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/
10. ThreatDown/Malwarebytes — "CastleRAT Cyber Attack Is the First to Abuse Deno JavaScript Runtime to Evade Enterprise Security" (March 10, 2026). https://www.threatdown.com/blog/castlerat-cyber-attack-is-the-first-to-abuse-deno-javascript-runtime-to-evade-enterprise-security/
11. Recorded Future — "From CastleLoader to CastleRAT: TAG-150 Advances Operations" (September 2025). https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations
12. ESET — "MuddyWater: Snakes by the riverbank" (December 2025). https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
13. Group-IB — "Operation Olalampo: Inside MuddyWater's Latest Campaign" (February 2026). https://www.group-ib.com/blog/muddywater-operation-olalampo/
14. Blackpoint Cyber — "A Match Made in Malware: Quick Assist" (March 18, 2026). https://blackpointcyber.com/blog/a-match-made-in-malware-quick-assist/
15. Symantec/Broadcom — "Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign" (May 12, 2026). https://www.security.com/threat-intelligence/iran-seedworm-electronics