MuddyWater

MuddyWater is an Iranian state-aligned cyber espionage threat actor widely assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS). Active since at least 2017, the group is best known for long-running intelligence collection and pre-positioning operations against government, defense, telecommunications, energy, financial, aviation, public-sector, education, and IT-service targets across the Middle East, Israel, the United States, Europe, and other regions. Common aliases include Seedworm, MERCURY, Static Kitten, Mango Sandstorm, Boggy Serpens, TA450, Temp.Zagros, Earth Vetala, Yellow Nix, Cobalt Ulster, and ITG17. The group’s operations consistently emphasize espionage, credential theft, network mapping, and durable access rather than overt disruption, although its intrusions have also been described as enabling later destructive or strategic effects. MuddyWater frequently conducts repeated spearphishing waves tailored to specific departments or individuals, often using malicious Office documents, VBA macros, external template abuse, HTML lures, and social engineering themes tied to business, travel, government, or technical support. More recent activity also shows adoption of collaboration-platform phishing and ClickFix-style user-execution lures. MuddyWater is notable for pragmatic tradecraft that blends custom malware, commodity tooling, living-off-the-land techniques, and legitimate remote management software. Reported malware and tooling associated with the actor include Dindoor, Fakeset, GhostFetch, GhostBackDoor, CHAR, HTTP_VIP, PowGoop, Small Sieve, Mori, POWERSTATS, Canopy or Starwhale, MuddyViper, Stagecomp, Darkcomp, and RustyWater. The group has also abused legitimate or dual-use tools and services such as AnyDesk, ScreenConnect, Atera, SimpleHelp, Action1, Level, PDQ, Syncro, Remote Utilities, Node.js, Deno, Rclone, Telegram, and cloud storage or file-sharing platforms to reduce signature-based visibility and blend malicious traffic with normal enterprise activity. Observed techniques include spearphishing attachment delivery, user execution, command and scripting interpreter abuse, DLL sideloading, reflective loading, ingress tool transfer, registry-based persistence, startup persistence, security software discovery, system information discovery, credential harvesting, Active Directory reconnaissance, cloud and identity enumeration, exfiltration over web services, and application-layer command and control. MuddyWater malware has been reported to check for security tools, collect host metadata such as operating system version and machine name, and use anti-analysis measures including obfuscated macros and sandbox-delay logic. The actor has also increasingly relied on trusted cloud services and low-signature infrastructure, reflecting a shift toward behaviorally stealthy operations rather than easily blocked indicator-heavy tradecraft. Recent reporting links MuddyWater to campaigns using Rust-based implants, Deno- and Python-based backdoors, Telegram-backed command channels, and malware-as-a-service or criminal ecosystem tooling such as CastleRAT MaaS and ChainShell. Victimology in 2025–2026 includes organizations in Israel, the broader Middle East, the United States, Canada, Europe, and Asia, with targeting spanning defense, energy, government, telecommunications, manufacturing, aviation, financial services, and software supply-chain-adjacent entities. The group’s operational pattern, infrastructure overlaps, and sustained use of social engineering and legitimate administration tooling make it a persistent Iranian espionage actor of high strategic relevance.