✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

FakeGit Campaign Revives to Spread SmartLoader Malware – Active IOCs

October 9, 2026

MuddyWater APT – Active IOCs

Severity

High

Analysis Summary

MuddyWater is an Iranian state-sponsored Advanced Persistent Threat (APT) group active since at least 2017 and associated with Iran’s Ministry of Intelligence and Security (MOIS). The group primarily conducts cyber espionage against government, telecommunications, defense, and oil and gas organizations across the Middle East, Asia, Europe, Africa, and North America.

MuddyWater commonly relies on spear-phishing and social engineering to gain initial access, often using malicious attachments, weaponized documents, and links to deliver malware. Its operations have involved PowerShell scripts, command-and-control (C2) infrastructure, remote administration tools, and malware designed to facilitate reconnaissance, persistence, and data theft.

Amid rising geopolitical tensions between Iran and Qatar, MuddyWater’s historical focus on government, telecommunications, and energy sectors makes its established tactics relevant to threat monitoring in Qatar. Organizations in these sectors should remain vigilant for phishing campaigns, credential theft, suspicious script execution, and unauthorized remote access. However, the available reporting does not confirm a MuddyWater campaign specifically targeting Qatar in connection with the current tensions.

Impact

  • Credential Theft
  • Exposure to Sensitive Information

Indicators of Compromise

Domain Name

  • rvxlan.online
  • queraniva.site
  • signning.cloud
  • vorpluxian.site
  • lucidware.click
  • zandrel.bond
  • syncridge.world
  • bakeloria.cloud
  • remisax.digital

IP

  • 2.26.133.156
  • 185.76.79.125

Remediation

  • Block all threat indicators at your respective controls.
  • Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
  • Log your eCommerce environment's network activity and web server activity.
  • Implement strong passwords.
  • Limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
  • Set up a Web Application Firewall with rules to block suspicious and malicious requests.
  • Patch and upgrade any platforms and software on time. Prioritize patching known exploited vulnerabilities.
  • Enable two-factor authentication.
  • Enable antivirus and anti-malware software and update signature definitions promptly.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo