This week, Tanium’s Cyber Threat Intelligence (CTI) team explores how attackers are combining two phishing-as-a-service kits into hybrid campaigns, making detection and attribution harder. Next, the team investigates RomCom, a Russian-linked threat group now targeting U.S. companies that support Ukraine.
Finally, we wrap up with an overview of Iran’s MuddyWater group, which recently launched a campaign targeting government and critical infrastructure in Israel and Egypt.
Hybrid 2FA phishing threatens enterprises
ANY.RUN is sounding the alarm about a new phishing threat that combines the Salty2FA and Tycoon2FA phishing kits into a single hybrid campaign. This evolution indicates a shift toward modular, resilient phishing operations that can adapt to infrastructure failures and evade traditional defenses.
ANY.RUN noticed a drop in Salty2FA sandbox submissions starting at the end of October 2025. By early November, the decline accelerated significantly, prompting ANY.RUN to investigate.
Researchers discovered that November samples were either non-functional or behaved differently than typical Salty2FA samples. At the same time, they observed sandbox results flagging indicators from both Salty2FA and Tycoon2FA in the same sample—evidence that attackers were blending the two kits into hybrid payloads.
How does the hybrid payload work?
This activity starts with a phishing page on Cloudflare Pages Dev, a platform for static site hosting and front-end development. Analysts found comments in the code indicating that if the initial payload fails to load, the script should fetch it from a backup URL. In the sample analyzed, the primary Salty2FA domain returned a DNS error, so the payload couldn’t be retrieved.
After that failure, the script followed its fallback path and requested the next stage. This stage runs anti-analysis checks, replaces the page content, blocks keyboard shortcuts for DevTools, and performs timing checks. Finally, the code loads a sequence that closely matches Tycoon2FA’s execution chain, which suggests Tycoon2FA serves as the backup payload when Salty2FA infrastructure is unavailable.
This fallback mechanism means attackers can maintain campaigns even when one kit’s infrastructure fails, reducing the effectiveness of single-point takedowns.
Analyst comments from Tanium’s Cyber Threat Intelligence team
This new hybrid campaign reflects a growing shift toward mature phishing ecosystems, where modularity and redundancy are built in. This is similar to how ransomware groups evolved into RaaS models. Phishing is now following suit.
Attackers are now prioritizing operational continuity, and switching from one phishing kit to another when infrastructure fails—a trend which mirrors enterprise-grade disaster recovery strategies. This makes takedown efforts less impactful unless both kits and their shared infrastructure are impacted.
ANY.RUN’s report includes practical advice about how SOC teams can respond to this activity.
RomCom uses SocGholish to deploy Mythic Agent malware
According to Arctic Wolf, the Russian-linked threat group RomCom is now using the SocGholish malware framework to deploy its Mythic Agent malware against U.S. companies actively supporting Ukraine. This marks the first time RomCom has leveraged SocGholish.
Arctic Wolf assessed with medium-to-high confidence that Russia’s GRU Unit 29155 was behind the attack, underscoring its geopolitical significance. Arctic Wolf detected and blocked the intrusion and is now sharing insights that reveal the growing sophistication and collaboration among Russian cyber actors.
RomCom, SocGholish, and TA569 overview
- RomCom is a Russian-aligned group active for at least three years, primarily targeting organizations that support Ukraine—whether through direct aid, partnerships, or related services—regardless of location.
- SocGholish is a malware framework first discovered in 2017. Delivered via malicious JavaScript injected into websites, it acts as a downloader and is increasingly used as an initial access vector for ransomware operations.
- TA569 is a financially motivated group that operates SocGholish as part of a Malware-as-a-Service model, selling access to compromised systems to ransomware affiliates. It is considered the primary threat actor deploying and maintaining SocGholish and uses fake browser and software update lures and malvertising to spread infections.
Understanding the attack vector
SocGholish typically injects malicious JavaScript into legitimate websites and uses fake update lures to trick users into downloading malware. It occasionally spreads via phishing. A SocGholish compromise can serve as an initial access point for further attacks, making early detection and containment critical.
In one observed case, just minutes before RomCom’s shellcode loader was delivered, the threat actors tested connectivity to Mythic command and control (C2), a multi-platform red-teaming framework written in Python 3 designed for security testing but, like many similar tools, is sometimes abused by threat actors to control compromised systems.
When does the loader activate?
With connectivity to Mythic C2 verified, the next stage of the attack can begin: delivery of RomCom’s loader. The loader, <code>msedge.dll</code>, checks if the system’s Active Directory domain matches a hardcoded value before decrypting and executing the shellcode. The shellcode in question is the Mythic agent, which then reaches out to its C2 infrastructure for further instructions.
Arctic Wolf detected and quarantined the loader at this stage, preventing the attack from progressing.
Analyst comments from Tanium’s Cyber Threat Intelligence team
As Arctic Wolf mentions, this is the first time RomCom has used SocGholish, suggesting that threat actors are increasingly blending criminal and geopolitical objectives.
The apparent coordination between RomCom and TA569 highlights how threat groups are forming alliances and working together to amplify impact, further complicating attribution and defense strategies for defenders.
If nothing else, the findings from Arctic Wolf reveal how critical layered defenses and behavioral analytics are against these evolving threats.
MuddyWater targets critical infrastructure with evolving tactics
A recent post from ESET reveals how MuddyWater launched a new campaign targeting government and critical infrastructure in Israel and Egypt using stealthier tactics and custom tools like the MuddyViper backdoor and Fooder loader.
This shift indicates the group’s evolution toward more sophisticated, defense-evasive operations, signaling increased capability and persistence.
Who is MuddyWater?
MuddyWater—also known as Mango Sandstorm or TA450—is an Iran-aligned cyberespionage group active since at least 2017. It primarily targets government and critical infrastructure sectors in the Middle East and beyond.
Earlier this year, ESET observed operational overlap between MuddyWater and Lyceum, a subgroup of the Iran-aligned OilRig (aka HEXANE). As ESET explains, this suggests MuddyWater “may be acting as an initial access broker for other Iran-aligned groups.”
MuddyWater’s toolset
ESET shared details of previously undocumented tools used by MuddyWater:
- Fooder loader: A 64-bit C/C++ loader that reflectively loads the MuddyViper backdoor into memory and executes it. Fooder has also been observed delivering the open-source utility HackBrowserData. Notable characteristics include a custom delay function and versions that masquerade as the classic Snake game.
- MuddyViper backdoor: A C/C++ backdoor that collects system information, downloads and uploads files, executes commands, and steals credentials. It maintains persistence via registry values or scheduled tasks and supports 20 backdoor commands. For C2 communication, it uses <code>HTTP GET</code> requests over <code>port 443</code> with verbose status updates.
- CE-Notes browser data stealer: First discovered in 2024, CE-Notes targets Chromium-based browsers (Chrome, Edge, Brave). It is downloaded via PowerShell and steals the app-bound encryption key introduced in Chrome version 127.
- LP-Notes credential stealer: A Windows credential stealer that displays a fake Windows Security dialog box to trick victims into entering credentials. It validates credentials in real time and attempts to log in using them.
- Blub browser data stealer: A C/C++ tool that gathers login data from Chrome, Edge, Firefox, and Opera. It uses a statically linked SQLite library and includes simple obfuscation techniques.
- Reverse tunnels: MuddyWater frequently uses go-socks5 reverse tunnels—a collection of Go-compiled tools based on libraries such as go-socks5, yamux, and resocks—to enable stealthy network communication and bypass firewalls.
Analyst comments from Tanium’s Cyber Threat Intelligence team
MuddyWater’s evolution from noisy, interactive sessions to stealthier, memory-resident techniques suggests a deliberate shift toward long-term persistence and evasion, which generally aligns with trends of state-sponsored actors.
MuddyWater is closing the gap with more sophisticated advanced persistent threats (APTs), which means defenders can’t rely on historical assumptions of certain groups. This activity still relies on spear phishing for initial access, but the combination with custom loaders disguised as games highlights the need for user awareness training and behavioral detection, not just signature-based defenses.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.