MuddyWater PatchAgent - Stage 3 HTTP C2 API Pattern

Georg Lauenstein@gsec

•updated Jul 21, 2026•0•0•8

Detects the PatchAgent Stage 3 HTTP C2 protocol recovered from the decrypted shellcode: plain HTTP requests to /api/checkin, /api/cmd/<id>, or /api/result/<id> combined with the hardcoded, truncated User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" (a real browser UA continues past this). Matching the API path plus the exact short UA keeps this durable across C2 IP rotation (observed on 46.30.188[.]99 and 185.228.83[.]217, port 8443).