MuddyWater

G0069

APT / State-SponsoredIranActive

Also known as: Earth Vetala · MERCURY · Static Kitten · Seedworm · TEMP.Zagros · Mango Sandstorm · TA450 · MuddyKrill

Active Since

2018-04-18

Overview

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.

MITRE ATT&CK — 50 techniques

Navigator →

T1566.002Spearphishing LinkInitial Access

T1137.001Office Template MacrosPersistence

T1574.001DLLStealth

T1588.002ToolResource Development

T1218.005MshtaStealth

T1204.004Malicious Copy and PasteExecution

T1047Windows Management InstrumentationExecution

T1534Internal SpearphishingLateral Movement

Malware & Tools — 21

MuddyViperMalwareWindows

STARWHALEMalwareWindows

LP-NotesMalwareWindows

POWERSTATSMalwareWindows

RcloneToolLinux / Windows / macOS

Out1ToolWindows

Tsundere BotnetMalwareLinux / macOS / Windows

PowerSploitToolWindows

Small SieveMalwareWindows

Fooder

References

https://blog.cloudflare.com/2026-threat-report/ →https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf →https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf →https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ →https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/ →https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict →https://www.cisa.gov/uscert/ncas/alerts/aa22-055a →https://hunt.io/blog/iranian-apt-infrastructure-state-aligned-clusters →https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/ →https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html →

← Back to Threat Actors

T1566.001Spearphishing AttachmentInitial Access

T1583.001DomainsResource Development

T1590.004Network TopologyReconnaissance

T1559.001Component Object ModelExecution

T1571Non-Standard PortCommand and Control

T1059.003Windows Command ShellExecution

T1588.001MalwareResource Development

T1218.003CMSTPStealth

T1036.005Match Legitimate Resource Name or LocationStealth

T1087.002Domain AccountDiscovery

T1059.007JavaScriptExecution

T1583.006Web ServicesResource Development

T1059.005Visual BasicExecution

T1016System Network Configuration DiscoveryDiscovery

T1547.001Registry Run Keys / Startup FolderPersistence

T1140Deobfuscate/Decode Files or InformationStealth

T1559.002Dynamic Data ExchangeExecution

T1027.010Command ObfuscationStealth

T1027.004Compile After DeliveryStealth

T1518.001Security Software DiscoveryDiscovery

T1074.001Local Data StagingCollection

T1113Screen CaptureCollection

T1071.001Web ProtocolsCommand and Control

T1685Disable or Modify ToolsDefense Impairment

T1518Software DiscoveryDiscovery

T1083File and Directory DiscoveryDiscovery

T1548.002Bypass User Account ControlPrivilege Escalation

T1105Ingress Tool TransferCommand and Control

T1573.001Symmetric CryptographyCommand and Control

T1567.002Exfiltration to Cloud StorageExfiltration

T1555.003Credentials from Web BrowsersCredential Access

T1566PhishingInitial Access

T1560.001Archive via UtilityCollection

T1684.001ImpersonationStealth

T1059.006PythonExecution

T1049System Network Connections DiscoveryDiscovery

T1082System Information DiscoveryDiscovery

T1555Credentials from Password StoresCredential Access

T1057Process DiscoveryDiscovery

T1132.001Standard EncodingCommand and Control

T1104Multi-Stage ChannelsCommand and Control

LaZagneToolLinux / macOS / Windows

PowGoopMalwareWindows

CrackMapExecToolWindows

ConnectWiseToolWindows

SHARPSTATSMalwareWindows

EmpireToolLinux / macOS / Windows

RustyWaterMalwareWindows

RemoteUtilitiesToolWindows