MuddyWater Masqueraded Binary Execution (CertificationKit.ini)

Ethan Andrews@eandrews

•updated Jan 12, 2026•4•0•55

Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns where a .ini file extension is used to disguise an executable, which is then launched via cmd.exe.