MuddyWater
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026,…
- ATT&CK ID
- G0069
- Origin
- Iran
- Weather family
- Sandstorm
- Techniques
- 48
- Tools
- 21
Also tracked as Earth Vetala · MERCURY · Static Kitten · Seedworm · TEMP.Zagros · Mango Sandstorm · TA450 · MuddyKrill
Vulnerabilities it has exploited
- CVE-2017-0199 Microsoft Office and WordPadUnscored · exploited in the wild
- CVE-2020-0688 Microsoft Exchange ServerUnscored · exploited in the wild
- CVE-2020-1472 Microsoft NetlogonUnscored · exploited in the wild
Techniques
Reconnaissance
Gather Victim Network Information
Resource Development
Acquire InfrastructureObtain Capabilities
Initial Access
Exploit Public-Facing ApplicationPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterExploitation for Client ExecutionUser ExecutionInter-Process CommunicationHijack Execution Flow
Persistence
Scheduled Task/JobOffice Application StartupBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobBoot or Logon Autostart ExecutionAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationMasqueradingDeobfuscate/Decode Files or InformationSystem Binary Proxy ExecutionHijack Execution FlowSocial Engineering
Defense Impairment
Credential Access
OS Credential DumpingUnsecured CredentialsCredentials from Password Stores
Discovery
System Network Configuration DiscoverySystem Owner/User DiscoverySystem Network Connections DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount DiscoverySoftware Discovery
Lateral Movement
Exploitation of Remote ServicesInternal Spearphishing
Collection
Data StagedScreen CaptureArchive Collected Data
Command and Control
Application Layer ProtocolProxyWeb ServiceMulti-Stage ChannelsIngress Tool TransferData EncodingRemote Access ToolsNon-Standard PortEncrypted Channel
Exfiltration
Exfiltration Over C2 ChannelExfiltration Over Web Service
Software
ConnectWise · CrackMapExec · Empire · Fooder · Koadic · LP-Notes · LaZagne · Mimikatz · Mori · MuddyViper · Out1 · POWERSTATS · PowGoop · PowerSploit · Rclone · RemoteUtilities · RustyWater · SHARPSTATS · STARWHALE · Small Sieve · Tsundere Botnet