MuddyWater Phoenix Backdoor DNS C2 Query to screenai.online

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.