MuddyWater PatchAgent - Regsvr32 Cloud.dll COM Dropper Execution

Georg Lauenstein@gsec

•updated Jul 21, 2026•0•0•9

Detects regsvr32 executing cloud.dll (or a similarly named DLL exporting DllRegisterServer) as observed in the MuddyWater-linked PatchAgent loader chain. Stage 1 is executed via 'regsvr32 /s cloud.dll' following ClickFix-style social engineering, invoking DllRegisterServer with no user interaction to begin the three-stage loader chain leading to a hollowed notepad.exe HTTP backdoor.