Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · MuddyWater · Nation-state · assessed origin Iran · misp-galaxy + mitre-attack · refreshed 2026-10-06

MuddyWater

  • TEMP.Zagros
  • Static Kitten
  • Seedworm
  • MERCURY
  • COBALT ULSTER
  • G0069
  • ATK51
  • Boggy Serpens

state sponsor · Iran (Islamic Republic of)MITRE G0069 ↗

MuddyWater — ATT&CK roseMU

attack rose · 68 techniques across 14 tactics

Analyst brief

misp-galaxy + mitre-attack

The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.

Observed targets (as stated by the sources)

9 countries · 1 sectors
Saudi ArabiaGeorgiaTürkiyeIraqIsraelIndiaUnited Arab EmiratesPakistanUnited StatesAssessed origin: Iran

assessed origin · Iranobserved targets · 9

countries · 9

  • Saudi Arabia
  • Georgia
  • Türkiye
  • Iraq
  • Israel
  • India
  • United Arab Emirates
  • Pakistan
  • United States

sectors · 1

  • Government

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

68 techniques · 14 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    4 techniques

  3. Initial access

    4 techniques

  4. Execution

    13 techniques

  5. Persistence

    2 techniques

  6. Privilege escalation

    1 technique

  7. Stealth

    10 techniques

  8. Defense impairment

    1 technique

  9. Credential access

    6 techniques

  10. Discovery

    9 techniques

  11. Lateral movement

    2 techniques

  12. Collection

    3 techniques

  13. Command and control

    10 techniques

  14. Exfiltration

    2 techniques

select a technique

Arsenal

11 malware · 10 tools
Malware
Malware · 11ATT&CK
MuddyViperS9032 ↗
STARWHALES1037 ↗
LP-NotesS9036 ↗
POWERSTATSS0223 ↗
Tsundere BotnetS9034 ↗
Small SieveS1035 ↗
FooderS9033 ↗
MoriS1047 ↗
PowGoopS1046 ↗
SHARPSTATSS0450 ↗
RustyWaterS9037 ↗
Tools
Tools · 10ATT&CK
RcloneS1040 ↗
Out1S0594 ↗
PowerSploitS0194 ↗
MimikatzS0002 ↗
LaZagneS0349 ↗
CrackMapExecS0488 ↗
ConnectWiseS0591 ↗
EmpireS0363 ↗
RemoteUtilitiesS0592 ↗
KoadicS0250 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs MuddyWater is cited as exploiting

none on KEV
  1. CVE-2017-01992026-10-17
    1. “Clearsky has detected new and advanced attack vector used by MuddyWater to target governmental entities and the telecommunication sector. Notably, the TTP includes decoy documents exploiting CVE-2017-0199 as the first stage of the attack.”

      cited as exploiting · source: clearskysec.com ↗ · 2026-10-17

    2. “MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2020-14722026-10-17
    1. “MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2020-06882026-10-17
    1. “MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2023MuddyWater eN-Able spear-phishing with new TTPsdeepinstinct ↗
  2. 2023Seedworm: Iranian Hackers Target Telecoms Orgs in North and East AfricaSymantec ↗
  3. 2022Iranian linked conglomerate MuddyWater comprised of regionally focused subgroupstalosintelligence ↗

Take it with you

keyless · no signup

References

24 sources
  1. 1.unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-midd…
  2. 2.cfr.org/interactive/cyber-operations/muddywater
  3. 3.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-upda…
  4. 4.blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-conn…
  5. 5.blog.trendmicro.com/trendlabs-security-intelligence/another-potential-mudd…
  6. 6.securelist.com/muddywater/88059
  7. 7.symantec.com/blogs/threat-intelligence/seedworm-espionage-group
  8. 8.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Le…
  9. 9.clearskysec.com/muddywater-targets-kurdish-groups-turkish-orgs
  10. 10.blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html
  11. +14 more in the JSON record

Track MuddyWater on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.