- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- State-sponsored, IRGC (Islamic Republic Guard Corps)
- Agency named
- MOIS, Ministry of Intelligence
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G0069 · 68 techniques
- Sources
- 14 sources carry it
- Identifier
- GINC-APT-0008 · muddywater
IranWhat it is
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- MuddyWater, Seedworm, TEMP.Zagros, Static Kitten, Static Kitten
- IBM X-Force
- ITG17
- Mandiant
- TEMP.Zagros, UNC3313
- Microsoft
- Mango Sandstorm
- MITRE ATT&CK
- G0069
- NSHC
- SectorD02
- Proofpoint
- TA450
- Thales
- ATK51
- Trend Micro
- Earth Vetala
- Operations
- Operation “BlackWater”, Operation “Earth Vetala”, Operation “Quicksand”
- Other names
- ATK 51, Boggy Serpens, Cobalt Ulster, DarkBit, Mango Sandstorm (Microsoft), MERCURY, MUDDY ION, Muddy Water, MUDDYCOAST, MuddyKrill, Seedworm, Static Kitten (CrowdStrike), T-APT-14, Yellow Nix
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
- MISP Galaxy (CFR tagging)Iran
- MicrosoftIran
- ThreatActor.info (Malpedia et al.)Iran · high
Targets
- Countries
- Afghanistan, Armenia, Austria, Azerbaijan, Bahrain, Belarus, Egypt, Georgia, India, Iran, Iraq, Israel, Jordan, Kuwait, Laos, Lebanon, Mali, Netherlands, Oman, Pakistan, Portugal, Qatar, Russia, Saudi Arabia, Sudan, Tajikistan, Tanzania, Thailand, Tunisia, Türkiye, Ukraine, United Arab Emirates, United States
- Sectors
- Aviation, Defense, Education, Energy, Financial, Food and Agriculture, Gaming, Government, Healthcare, High-Tech, IT, Media, NGOs, Oil and Gas, Shipping and Logistics, Telecommunications, Transportation
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- BugSleep
- CLOUDSTATS
- ChromeCookiesView
- Cobalt Strike
- ConnectWise
- Covicli
- CrackMapExec
- Crackmapexec
- DCHSpy
- DELPHSTATS
- DarkBit
- Empire
- EmpireProject
- Fooder
- FruityC2
- GRAMDOOR
- Koadic
- LP-Notes
- LaZagne
- Living off the Land
- MZCookiesView
- Meterpreter
- Mimikatz
- Mori
- MoriAgent
- MuddyC2Go
- MuddyRot
- MuddyViper
- Mudwater
- Out1
- POWERSOURCE
- POWERSTATS
- PRB-Backdoor
- PhonyC2
- PowGoop
- PoweMuddy
- Power Loader
- PowerDuke
- PowerRAT
- PowerSploit
- Powermud
- Pudpoul
- QUADAGENT
- Rclone
- RemoteUtilities
- RustyWater
- SHARPSTATS
- STARWHALE
- ScreenConnect
- Secure Socket Funneling
- Shootback
- Small Sieve
- Smbmap
- TINY
- Thanos Ransomware
- Tsundere
- Tsundere Botnet
- Unidentified VBS 004 (RAT)
- chrome-passwords
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de