MalwareUsed by 1 actor

MuddyC3

MuddyC3 is a malware/tool associated with the espionage-focused threat group COBALT ULSTER, also known as MuddyWater, Seedworm, MERCURY, Mango Sandstorm, TA450, and other aliases. CTU researchers assess with moderate confidence that COBALT ULSTER operates on behalf of Iran and has conducted operations since at least 2017. The group has targeted government, telecommunications, oil and gas, and education organizations across the Middle East, Central Asia, and North America, including NGOs and Middle Eastern governments in late 2019 and early 2020. MuddyC3 appears in reporting as part of the group’s broader tooling ecosystem alongside PowerStats, FORELORD, Mori, PowGoop, Small Sieve, Canopy, PhonyC2, MuddyC2Go, Venom Proxy, and numerous publicly available offensive tools such as Metasploit, LaZagne, Koadic, CrackMapExec, Empire, Mimikatz, Plink, WMIExec, Ligolo, and Revsocks. The group commonly uses macro-enabled phishing documents for initial access, leverages compromised infrastructure for command and control, and has inserted false flags into code to complicate attribution and analysis. The provided content does not describe MuddyC3’s specific technical capabilities, infection chain, or indicators of compromise beyond its association with COBALT ULSTER and its inclusion in that actor’s toolset.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

MuddyWater

ToolsPowerStats, Koadic, LaZagne, Metasploit, FORELORD, CrackMapExec, Plink, Empire, Mimikatz, Mori, PowGoop, Small Sieve, Canopy, ScreenConnect, RemoteUtilities, Syncro, SimpleHelp, MiniDump, CredNinja, MKL64, Ligolo, MuddyC3, PhonyC2, MuddyC2Go, Venom Proxy, WMIExec, AnyDesk, Revsocks

via secureworks threat profilessecureworks.com

MITRE ATT&CK

Techniques & procedures

2 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.006Web ServicesEvidence1

"COBALT ULSTER leverages compromised infrastructure for command and control."

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

COBALT ULSTER leverages compromised infrastructure for command and control.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

secureworks threat profilesNews

Mar 18, 2026

COBALT ULSTER

Named command-and-control tooling used by COBALT ULSTER.

secureworks threat profilesNews

Mar 18, 2026

COBALT ULSTER

Named command-and-control tooling used by COBALT ULSTER.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping2

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

MuddyC3