Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 21:58:45 UTC
Home > List all groups > List all tools > List all groups using tool PhonyC2
 Tool: PhonyC2
Names PhonyC2
Category Malware
Type Backdoor
Description
(Deep Instinct) With the knowledge we gathered from investigating the source code of
PhonyC2 we believe that PhonyC2 is a successor to MuddyC3 and POWERSTATS.
Information
<https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/ps1.phonyc2>
Last change to this tool card: 13 October 2023
Download this tool card in JSON format
All groups using tool PhonyC2
Changed Name Country Observed
APT groups
  MuddyWater, Seedworm, TEMP.Zagros, Static Kitten 2017-Jul 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4e823896-5834-4487-a14e-3eb17db56f4c
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4e823896-5834-4487-a14e-3eb17db56f4c
Page 1 of 1