Loading story…
Boggy Serpens—also tracked as MuddyWater and linked to Iran’s Ministry of Intelligence and Security—has expanded a long-running cyberespionage effort targeting diplomatic entities and critical sectors including energy, maritime, aviation, and finance. Reporting indicates the group has shifted from broad, noisy spear-phishing and remote management tool abuse toward more deliberate operations focused on long-term persistence, trusted relationship compromise, and custom Rust-based malware, with activity observed across the Middle East, Europe, and South America. One cited campaign involved multiple attack waves against a UAE-based target, and researchers also noted coordination with Evasive Serpens/Lyceum, suggesting resource sharing within the broader Iranian threat ecosystem.
Broader coverage in the cluster reinforces that Iranian cyber activity remains a live concern for defenders, particularly against critical infrastructure and enterprise environments, even where no single surge in activity has been confirmed. U.S. officials said they had not observed an overall uptick in Iran-linked cyber threats despite regional conflict, but noted ongoing response work tied to an attack attributed to the Iran-linked Handala group. Additional material on Iranian tradecraft highlights recurring use of password spraying, exploitation of known vulnerabilities, legitimate administrative tools, and persistence-focused intrusion methods, which aligns with the operational evolution described for Boggy Serpens. Generic articles on critical infrastructure risk and APT defense provide context, but separate reporting on SideWinder and ad-tech privacy abuses is unrelated to the same event.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Unit 42 reported that Boggy Serpens, also known as MuddyWater, conducted a multi-wave espionage campaign from August 2025 through February 2026 targeting diplomatic, energy, maritime, government, aviation, and financial organizations across several countries. The report highlighted use of compromised email accounts, fake diplomatic invitations, custom Rust-based implants, and malware families including BugSleep, Nuso, and UDPGangster.
CISA Acting Director Nick Andersen said the U.S. government had not observed an increase in Iran-linked cyber threats since U.S. and Israeli strikes in Iran late the previous month. He said the agency was coordinating with industry and sector groups while urging defenders to remain vigilant.
Reporting described a recurring Iranian cyber operations model centered on password spraying, exploitation of known N-day vulnerabilities, and living-off-the-land techniques using tools such as PowerShell and RDP. The activity was associated with groups including Pioneer Kitten and Seedworm and was presented as an ongoing pattern rather than a single new incident.
Stryker suffered a cyberattack on March 11 that U.S. officials attributed to the Iran-linked group Handala. CISA later said it was still assisting the company in responding to the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetherecord.media
Open sourcecobalt.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iranian state-aligned and affiliated cyber activity has expanded beyond traditional disruptive malware into a broader campaign of **hybrid operations** that combines espionage, reconnaissance, credential abuse, and destructive effects. Reporting describes a tactical shift from bespoke wipers toward **living-off-the-land** methods, including the compromise of highly privileged identities and the use of legitimate enterprise administration capabilities to issue remote-wipe actions at scale. At the same time, Iranian operators and aligned personas have been linked to sustained access into US organizations in sectors including banking, aviation, defense-adjacent industries, and healthcare, while also targeting internet-connected surveillance infrastructure in the Middle East for intelligence collection and battlefield awareness. The activity is unfolding alongside a wider surge in hostile traffic associated with the regional conflict, with major increases in infrastructure scanning, automated reconnaissance, credential harvesting, and DDoS preparation against critical businesses, especially **banking and fintech**. One report highlights **Handala/Void Manticore** as emblematic of the disruptive trend, while another ties **MuddyWater** to persistent footholds in US networks and notes exploitation of camera vulnerabilities such as `CVE-2017-7921` and `CVE-2021-33044`. Together, the reporting indicates that Iranian cyber operations remain active and adaptive, using proxy infrastructure, compromised identities, and exposed edge devices to sustain pressure on commercial and strategic targets without relying solely on custom malware.
Jun 29, 2026
Iran-nexus cyber activity intensified alongside regional military escalation, with multiple reporting streams describing both opportunistic and targeted operations. Check Point Research observed a coordinated campaign to compromise internet-connected **IP cameras** across Israel, the UAE, Qatar, Bahrain, Kuwait, Lebanon, and Cyprus, with spikes in exploitation attempts aligning to geopolitical events; activity was traced to infrastructure linked to Iran-nexus actors using commercial VPN exit nodes (e.g., *Mullvad*, *ProtonVPN*, *Surfshark*, *NordVPN*) and VPS infrastructure to mask origin, and the most targeted vendors were **Hikvision** and **Dahua**. Separately, Symantec reported **Seedworm** (*MuddyWater/Temp Zagros/Static Kitten*) activity on multiple U.S. and Canadian organizations beginning in February 2026, including a U.S. bank, airport, non-profit, and the Israeli operations of a U.S. software supplier to defense/aerospace; Symantec identified a previously unknown backdoor dubbed **Dindoor** (leveraging the *Deno* runtime) and a Python backdoor **Fakeset**, with malware signed using certificates issued to “**Amy Cherne**” (and in some cases “**Donald Gay**”), and noted attempted data exfiltration using **Rclone** to a *Wasabi* cloud storage bucket. Additional coverage indicates broader pro-Iranian cyber activity but is less specific to the above intrusions. ASEC’s weekly “Ransom & Dark Web Issues” roundup flags **pro-Iranian/pro-Islamist hacktivist** attacks against Middle Eastern and pro-Western targets, but provides limited technical detail in the excerpt. A podcast episode describing “Iran’s 12 days of cyber war” and global OT targeting (including *Unitronics* PLCs) is largely commentary and retrospective framing rather than a discrete, verifiable incident report, and two other items in the set (a Russia-linked **APT28** phishing/malware campaign in Ukraine and a China-nexus **UAT-9244** telecom intrusion set in South America) describe unrelated threat activity outside the Iran-focused escalation.
Jul 22, 2026
Following the Feb. 28, 2026 U.S.-Israeli strikes on Iran, reporting indicates a **heightened risk of Iranian retaliatory cyber activity** against U.S. and allied organizations, with expected operations spanning **ransomware, DDoS (including as cover for deeper intrusions), data leaks from prior exfiltration, and aggressive social engineering** (e.g., fake job offers and malicious attachments). Likely target sets highlighted include **critical infrastructure**, **banking**, and environments involving **industrial control systems/PLCs**, with emphasis on disciplined execution of security fundamentals (patching, log review, and tighter email/attachment handling) rather than overreliance on automation. Separately, **MuddyWater** (*Seedworm*), an Iran-linked APT, was reported active in multiple U.S. organizations since early Feb. 2026, with activity increasing after the strikes. Symantec and Carbon Black researchers described targeting that included a **U.S. bank**, an **airport**, a **non-profit**, and the **Israel operation of a U.S. software company** supplying the defense/aerospace sector, and identified a previously unknown backdoor, **Dindoor**, observed in several victims; **Dindoor executes via `Deno`** (a JavaScript/TypeScript runtime). Commentary in the reporting also warned to assume potential **pre-positioning** in high-value targets and recommended proactive hunting for signs of persistent access before activation.
Jun 29, 2026