Iranian linked threat organization MuddyWater has been operating a new campaign targeting entities throughout the Arabian and Turkey regions. Historically, MuddyWater specializes in cyber espionage, sensitive information extortion, and ransomware attacks with the known technique of utilizing living-off-the-land scripts to move throughout their targets. Often times, MuddyWater will conduct malicious activity against telecommunications providers, national & local governments, ministries, universities, and other private companies. This recent campaign delivered through social engineering incorporates a Windows script file remote access trojan dubbed “SloughRAT”. This obfuscated trojan will attempt to execute malicious code and commands passed by actor-controlled command-and-control communications. Once SloughRAT is properly installed on the victim device, it allows the deployment of Ligolo, an open-source reverse-tunneling tool which strengthens the control of infected endpoints communicating with actor servers. CTIX analysts urge users to verify the integrity of all emails prior to executing any hyperlinks or attachments in order to prevent threat actors from compromising your devices.