🇮🇷

MuddyWater

APT Group Information theft and espionage 33 zero-day CVEs ETDA ✓

Also Known As 11 names

ATK51 Boggy Serpens COBALT ULSTER Earth Vetala G0069 MERCURY Mango Sandstorm Seedworm Static Kitten TA450 TEMP.Zagros

Target Countries 34

Countries highlighted in red

United Arab Emirates Afghanistan Armenia Austria Azerbaijan Bahrain Belarus China Germany Egypt United Kingdom Georgia Israel India Iraq Islamic Republic of Iran Jordan Kuwait Lebanon Mali Netherlands Oman Pakistan Portugal Qatar Saudi Arabia Sudan Thailand Tajikistan Tunisia Turkey United Republic of Tanzania Ukraine United States

Sectors Targeted

Colleges, Universities, and Professional Schools 6113 NGOs Oil and gas Healthcare Data Processing, Hosting, and Related Services 51821 Grantmaking and Giving Services 8132 Employment Placement Agencies and Executive Search Services 56131 Computer Systems Design Services 541512 Gaming High-Tech Education Telecommunications IT Energy Defense Financial Human Resources Consulting Services 541612 Food and Agriculture Commercial Banking 52211 Transportation National Security and International Affairs 9281 National Security and International Affairs 928110 Shipping and Logistics Media Aviation Government

Details

Origin 🇮🇷 IR

Last Updated 27 Oct 2025

Malware Families 25

gramdoor

equationgroup

evilquest

TeamViewer

ascentloader

METASPLOIT

dreambot

phoenix_locker

snifula

agent_tesla

zhmimikatz

ldr4

apk.rat_on

moriagent

pas

phoenix_keylogger

covicli

eternal_petya

saigon

vawtrak

PhantomCard

dbatloader

win.castleloader

agendacrypt

gozi

MITRE ATT&CK 199

T1001 - Data Obfuscation T1003 - OS Credential Dumping T1003.001 T1003.004 T1003.005 T1005 - Data from Local System T1007 T1008 T1011 T1012 - Query Registry T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1021 - Remote Services T1021.001 - Remote Desktop Protocol T1027 - Obfuscated Files or Information T1027.002 - Software Packing T1027.003 T1027.004 T1027.010 T1033 - System Owner/User Discovery T1036 - Masquerading T1036.005 T1041 - Exfiltration Over C2 Channel T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1048 - Exfiltration Over Alternative Protocol T1049 - System Network Connections Discovery T1053 - Scheduled Task/Job T1053.005 T1055 - Process Injection T1056 - Input Capture T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1059.003 T1059.005 - Visual Basic T1059.006 - Python T1059.007 - JavaScript T1060 T1068 - Exploitation for Privilege Escalation T1070 - Indicator Removal on Host T1070.001 - Clear Windows Event Logs T1070.004 - File Deletion T1071 - Application Layer Protocol T1071.001 - Web Protocols T1074 T1074.001 T1076 T1078 - Valid Accounts T1078.003 - Local Accounts T1078.004 - Cloud Accounts T1081 T1082 - System Information Discovery T1083 - File and Directory Discovery T1085 T1087 - Account Discovery T1087.002 T1089 T1090 - Proxy T1090.002 T1095 - Non-Application Layer Protocol T1102 - Web Service T1102.002 T1102.003 - One-Way Communication T1104 T1105 - Ingress Tool Transfer T1106 - Native API T1107 T1110 T1112 - Modify Registry T1113 - Screen Capture T1114 - Email Collection T1114.001 T1115 T1119 T1120 T1124 T1125 - Video Capture T1127 T1130 T1132 - Data Encoding T1132.001 - Standard Encoding T1133 - External Remote Services T1134 - Access Token Manipulation T1136 T1136.001 - Local Account T1137 T1137.001 T1140 - Deobfuscate/Decode Files or Information T1170 T1176 - Browser Extensions T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application T1192 - Spearphishing Link T1193 T1195 - Supply Chain Compromise T1199 - Trusted Relationship T1203 - Exploitation for Client Execution T1204 - User Execution T1204.001 T1204.002 - Malicious File T1204.004 T1210 T1213 - Data from Information Repositories T1217 T1218 - Signed Binary Proxy Execution T1218.003 T1218.005 T1218.011 T1219 - Remote Access Software T1219.002 T1220 T1444 T1480 T1485 T1486 T1489 T1490 - Inhibit System Recovery T1496 - Resource Hijacking T1497 T1497.003 T1498 - Network Denial of Service T1499 T1503 T1505.003 T1514 T1518 T1518.001 T1529 T1530 T1531 T1534 T1539 - Steal Web Session Cookie T1543 T1547 - Boot or Logon Autostart Execution T1547.001 - Registry Run Keys / Startup Folder T1548 - Abuse Elevation Control Mechanism T1548.002 T1550 - Use Alternate Authentication Material T1552 - Unsecured Credentials T1552.001 T1553 - Subvert Trust Controls T1553.002 - Code Signing T1555 T1555.003 - Credentials from Web Browsers T1559 T1559.001 T1559.002 T1560 - Archive Collected Data T1560.001 T1561 T1562 - Impair Defenses T1562.001 T1564 - Hide Artifacts T1566 - Phishing T1566.001 - Spearphishing Attachment T1566.002 T1567 T1567.002 - Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1569 - System Services T1569.002 - Service Execution T1571 - Non-Standard Port T1572 T1573 - Encrypted Channel T1573.001 - Symmetric Cryptography T1574 - Hijack Execution Flow T1574.001 T1574.002 - DLL Side-Loading T1578.003 T1583 - Acquire Infrastructure T1583.001 - Domains T1583.004 - Server T1583.006 T1584 - Compromise Infrastructure T1584.004 - Server T1585.001 - Social Media Accounts T1585.002 - Email Accounts T1587 - Develop Capabilities T1587.001 - Malware T1588 - Obtain Capabilities T1588.001 - Malware T1588.002 - Tool T1589 - Gather Victim Identity Information T1590 T1590.004 T1591 - Gather Victim Org Information T1592 - Gather Victim Host Information T1595 - Active Scanning T1596 - Search Open Technical Databases T1598.002 T1608 - Stage Capabilities T1608.001 - Upload Malware T1684 T1684.001 T1685 TA0003 TA0010 TA0037

Related Zero-Days 33

CVE-2017-0199 CVE-2017-5638 CVE-2018-8174 CVE-2019-0708 CVE-2019-11510 CVE-2020-1472 CVE-2021-26855 CVE-2021-40444 CVE-2021-44228 CVE-2022-3236 CVE-2022-42475 CVE-2023-20109 CVE-2023-20198 CVE-2023-22515 CVE-2023-27350 CVE-2023-36884 CVE-2023-38831 CVE-2023-46604 CVE-2023-4966 CVE-2024-21412 CVE-2024-23222 CVE-2024-38112 CVE-2024-38193 CVE-2024-4040 CVE-2024-43093 CVE-2024-43461 CVE-2024-47575 CVE-2025-1316 CVE-2025-22457 CVE-2025-27363 CVE-2025-52691 CVE-2025-6218 CVE-2025-8088

Known Names 14 entries

MuddyWater Palo Alto

Seedworm Symantec

TEMP.Zagros FireEye

Static Kitten CrowdStrike

Mercury Microsoft

TA450 Proofpoint

Cobalt Ulster SecureWorks

ATK 51 Thales

T-APT-14 Tencent

ITG17 IBM

Mango Sandstorm Microsoft

Boggy Serpens Palo Alto

Yellow Nix PWC

G0069 MITRE

Observed Target Countries 33

Based on ETDA data — countries highlighted in red

Afghanistan Armenia Austria Azerbaijan Bahrain Belarus Egypt Georgia India Iran Iraq Israel Jordan Kuwait Laos Lebanon Mali Netherlands Oman Pakistan Portugal Qatar Russia Saudi Arabia Sudan Tajikistan Tanzania Thailand Tunisia Turkey UAE Ukraine USA

Description

(Reaqta) MuddyWater is an APT group that has been active throughout 2017, targeting victims in Middle East with in-memory vectors leveraging on Powershell, in a family of attacks now identified as “Living off the land”, as they don’t require the creation of new binaries on the victim’s machine, thus maintaining a low detection profile and a low forensic footprint. The operators behind MuddyWater are likely espionage motivated, we derive this information from the analysis of data and backdoors behaviors. We also find that despite the strong preponderance of victims from Pakistan, the most active targets appear to be in: Saudi Arabia, UAE and Iraq. Amongst the victims we identify a variety of entities with a stronger focus at Governments, Telcos and Oil companies. By tracking the operations we finally figure out that the originating country is likely to be Iran, while it remains harder to ascertain whether MuddyWater is state sponsored or a criminal organization incline to espionage.

Tools Used 29

BugSleep ChromeCookiesView chrome-passwords CLOUDSTATS Cobalt Strike CrackMapExec DCHSpy DELPHSTATS EmpireProject FruityC2 Koadic LaZagne Meterpreter Mimikatz MuddyC2Go Mudwater MZCookiesView PhonyC2 Powermud PowerSploit POWERSTATS PowGoop PRB-Backdoor QUADAGENT Secure Socket Funneling SHARPSTATS Shootback Smbmap Living off the Land

Operations 32

2017-02 The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/

2018-01 Updated Tactics, Techniques and Procedures in Spear Phishing Campaign We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017. This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia. https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html

2018-03 Campaign Possibly Connected to “MuddyWater” Surfaces in the Middle East and Central Asia We discovered a new campaign targeting organizations in Turkey, Pakistan and Tajikistan that has some similarities with an earlier campaign named MuddyWater, which hit various industries in several countries, primarily in the Middle East and Central Asia. https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/

2018-05 Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor In May 2018, we found a new sample (Detected as W2KM_DLOADR.UHAOEEN) that may be related to this campaign. Like the previous campaigns, these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell (PS) scripts leading to a backdoor payload. One notable difference in the analyzed samples is that they do not directly download the Visual Basic Script(VBS) and PowerShell component files, and instead encode all the scripts on the document itself. The scripts will then be decoded and dropped to execute the payload without needing to download the component files. https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/

2018-05 We recently noticed a large amount of spear phishing documents that appear to be targeting government bodies, military entities, telcos and educational institutions in Jordan, Turkey, Azerbaijan and Pakistan, in addition to the continuous targeting of Iraq and Saudi Arabia, other victims were also detected in Mali, Austria, Russia, Iran and Bahrain.. These new documents have appeared throughout 2018 and escalated from May onwards. The attacks are still ongoing. https://securelist.com/muddywater/88059/

2018-09 Group remains highly active with more than 130 victims in 30 organizations hit since September 2018. Seedworm’s motivations are much like many cyber espionage groups that we observe—they seek to acquire actionable information about the targeted organizations and individuals. They accomplish this with a preference for speed and agility over operational security, which ultimately led to our identification of their key operational infrastructure. https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group

2018-11 Operations in Lebanon and Oman MuddyWater has recently been targeting victims likely from Lebanon and Oman, while leveraging compromised domains, one of which is owned by an Israeli web developer. The investigation aimed to uncover additional details regarding the compromise vector. Further, we wished to determine the infection vector, which is currently unknown. With that in mind, past experience implies that this might be a two-stage spear-phishing campaign. https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf

2019-04 Targeting Kurdish Political Groups and Organizations in Turkey However, unlike the previous vector, we did not identify this time any compromised servers used to host the malware’s code. Instead, the lure document already contains the malicious code. We also detected five additional files that operate in a similar file to the aforementioned document; but unlike that file, these do not have any content. https://www.clearskysec.com/muddywater-targets-kurdish-groups-turkish-orgs/

2019-04 The Iranian APT, MuddyWater, has been active since at least 2017. Most recently though, a new campaign, targeting Belarus, Turkey and Ukraine, has emerged that caught the attention of Check Point researchers. https://research.checkpoint.com/the-muddy-waters-of-apt-attacks/

2019-04 Operation “BlackWater” Newly associated samples from April 2019 indicate attackers have added three distinct steps to their operations, allowing them to bypass certain security controls and suggesting that MuddyWater’s tactics, techniques and procedures (TTPs) have evolved to evade detection. https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html

2019-06 Clearsky has detected new and advanced attack vector used by MuddyWater to target governmental entities and the telecommunication sector. Notably, the TTP includes decoy documents exploiting CVE-2017-0199 as the first stage of the attack. This is followed by the second stage of the attack – communication with the hacked C2 servers and downloading a file infected with the macros. https://www.clearskysec.com/muddywater2/

2019-06 We came across new campaignsthat seem to bear the markings of MuddyWater –a threat actor group with a history of targeting organizations in Middle Eastern and Asian countries. The group used new tools and payloads in campaigns over the first half of 2019, pointing to the continued work the group has put in since our last report on MuddyWaterin November 2018. https://documents.trendmicro.com/assets/white_papers/wp_new_muddywater_findings_uncovered.pdf

2019-12 Group continues to be highly active in 2020, while tentative links to recently discovered PowGoop tool suggest possible retooling. https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east

2019 State-sponsored hackers abuse Slack API to steal airline data https://www.bleepingcomputer.com/news/security/state-sponsored-hackers-abuse-slack-api-to-steal-airline-data/

2020-09 Operation “Quicksand” During September 2020, weidentified a new campaign targeting many prominent Israeli organizations. https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf

2020-10 MSTIC has observed activity by the nation-state actor MERCURY using the CVE-2020-1472 exploit (ZeroLogon) in active campaigns over the last 2 weeks. https://www.zdnet.com/article/microsoft-says-iranian-hackers-are-exploiting-the-zerologon-vulnerability/

2020-12 GitHub-hosted malware calculates Cobalt Strike payload from Imgur pic https://www.bleepingcomputer.com/news/security/github-hosted-malware-calculates-cobalt-strike-payload-from-imgur-pic/

2021-02 Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies

2021-02 Operation “Earth Vetala” Earth Vetala used spearphishing emails with embedded links to a legitimate file-sharing service to distribute their malicious package. The links were embedded within lure documents as well as emails. https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html

2021-06 Espionage Campaign Targets Telecoms Organizations across Middle East and Asia https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-campaign-telecoms-asia-middle-east

2021-11 Iranian APT MuddyWater targets Turkish users via malicious PDFs, executables https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html

2021 Late New MuddyWater Threat: Old Kitten; New Tricks https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks

2022 Late APT groups muddying the waters for MSPs https://www.welivesecurity.com/2023/05/02/apt-groups-muddying-waters-msps/

2023-04 MERCURY and DEV-1084: Destructive attack on hybrid environment https://www.microsoft.com/en-us/security/blog/2023/04/07/mercury-and-dev-1084-destructive-attack-on-hybrid-environment/

2023-04 PhonyC2: Revealing a New Malicious Command & Control Framework by MuddyWater https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater

2023-05 Microsoft: Iranian hacking groups join Papercut attack spree https://www.bleepingcomputer.com/news/security/microsoft-iranian-hacking-groups-join-papercut-attack-spree/

2023-07 MuddyC2Go – Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel

2023-10 MuddyWater eN-Able spear-phishing with new TTPs https://www.deepinstinct.com/blog/muddywater-en-able-spear-phishing-with-new-ttps

2023-11 Seedworm: Iranian Hackers Target Telecoms Orgs in North and East Africa https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/iran-apt-seedworm-africa-telecoms

2024-03 Security Brief: TA450 Uses Embedded Links in PDF Attachments in Latest Campaign https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign

2024-05 MuddyWater Threat Group Deploys New BugSleep Backdoor https://blog.checkpoint.com/research/muddywater-threat-group-deploys-new-bugsleep-backdoor/

2025-07 Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict https://www.lookout.com/threat-intelligence/article/lookout-discovers-iranian-dchsy-surveillanceware

Reports & References 6

https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/ https://www.cisa.gov/uscert/ncas/alerts/aa22-055a https://blog.talosintelligence.com/2022/03/iranian-supergroup-muddywater.html https://www.group-ib.com/blog/muddywater-infrastructure/

ETDA Profile

MuddyWater, Seedworm, TEMP.Zagros, Static Kitten

Origin

Iran

First Seen 2017

Sponsor State-sponsored, IRGC (Islamic Republic Guard Corps)

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0069/

View on ETDA APT Groups ↗