MuddyWater Masqueraded Binary Execution (CertificationKit.ini)

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•1

Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns, where a file with a .ini extension is used for execution, often via cmd.exe.