MITRE ATT&CKgroup
G0069 MuddyWater
- Domain
- enterprise, mobile
- Aliases
- Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill
- Version
- 7.0
- Created
- 2018-04-18
Description
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.
Related
Uses · MITRE ATT&CK (90)
- S9036 LP-Notes software (malware)
- S9037 RustyWater software (malware)
- S9032 MuddyViper software (malware)
- S9033 Fooder software (malware)
- S9034 Tsundere Botnet software (malware)
- T1684.001 Impersonation sub-technique
- T1685 Disable or Modify Tools technique
- S1243 DCHSpy software (malware)
- T1219.002 Remote Desktop Software sub-technique
- T1204.004 Malicious Copy and Paste sub-technique
- T1027.010 Command Obfuscation sub-technique
- S1047 Mori software (malware)
- S1046 PowGoop software (malware)
- S1040 Rclone software (tool)
- S1037 STARWHALE software (malware)
- S1035 Small Sieve software (malware)
- S0594 Out1 software (tool)
- S0591 ConnectWise software (tool)
- S0592 RemoteUtilities software (tool)
- T1590.004 Network Topology sub-technique
- T1583.006 Web Services sub-technique
- T1588.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- S0488 CrackMapExec software (tool)
- T1059.007 JavaScript sub-technique
- S0450 SHARPSTATS software (malware)
- T1027.004 Compile After Delivery sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
References
- https://blog.cloudflare.com/2026-threat-report/ Cloudflare 2026 Threat Report New Threat Actors March 2026
- https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf ClearSky MuddyWater Nov 2018
- https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf ClearSky MuddyWater June 2019
- https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ CYBERCOM Iranian Intel Cyber January 2022
- https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/ ESET_MuddyWater_Dec2025
- https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict FalconFeeds_Iran_Mar2026
- https://www.cisa.gov/uscert/ncas/alerts/aa22-055a DHS CISA AA22-055A MuddyWater February 2022
- https://hunt.io/blog/iranian-apt-infrastructure-state-aligned-clusters Huntio_IranInfra_Mar2026
- https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/ Unit 42 MuddyWater Nov 2017
- https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html Talos MuddyWater Jan 2022
- https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies Anomali Static Kitten February 2021
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign Proofpoint TA450 Phishing March 2024
- https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix NaumaanProofpoint_GlobalClickFix_April2025
- https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html Trend Micro Muddy Water March 2021
- https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ Reaqta MuddyWater November 2017
- https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html FireEye MuddyWater Mar 2018
- https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group Symantec MuddyWater Dec 2018
- https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us SymantecCarbonBlack_Seedworm_Mar2026