Executive Summary
A recent analysis identifies a sophisticated malware campaign attributed to Muddywater (described as a suspected APT28 variant). The attack chain begins with a malicious payload packaged using the legitimate Inno Setup framework, which drops an executable named 'update.exe' into the user's AppData directory. The malware establishes persistence by creating a startup shortcut named 'MicrosoftUpdateSerice.lnk'—notably misspelling 'Service' to evade casual inspection—and by registering itself as a COM component.
Technical analysis reveals that the malware, known as the Moodleuni C2 RAT, employs advanced evasion techniques including kernel-level API calls (NTDLL), hidden console windows, and abuse of the Windows Application Compatibility Shims (SDB files). The malware communicates with its command-and-control (C2) infrastructure at moodleuni[.]com, utilizing encrypted JSON payloads over HTTPS to exfiltrate system fingerprinting data and receive remote commands.
This threat is significant due to its high level of stealth and multi-stage persistence mechanisms. By impersonating legitimate Microsoft update services and utilizing binary padding and obfuscated strings, the actor demonstrates a clear intent to remain resident on targeted systems for long-term intelligence gathering and data exfiltration.