MuddyWater PatchAgent - COM Hijack via cloud.dll CLSID Registration

Georg Lauenstein@gsec

•updated Jul 22, 2026•1•0•21

Detects the COM hijacking persistence used by the MuddyWater-linked PatchAgent loader chain: cloud.dll registers itself under the campaign-specific CLSID {7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32 via DllRegisterServer, so any later COM instantiation of that CLSID re-loads and re-executes the Stage 1 dropper. The CLSID is a hard, campaign-unique indicator.