MuddyWater Linked to Iranian MOIS Uses Russian MaaS in ChainShell Campaign
Threat Actor Intelligence · 4 sources · Updated 4mo ago · First seen Apr 9, 2026
Iran-linked threat group MuddyWater has been tied to a ChainShell campaign that reportedly uses Russian malware-as-a-service infrastructure, underscoring growing overlap between state-backed espionage and criminal tooling. Reporting on the activity said the operation relied on blockchain-based command-and-control and reflected operational links between the Iran-aligned actor and Russian cybercrime services, extending a long-running pattern of MuddyWater adapting external tools and tradecraft for intrusion operations.
U.S. and allied agencies have previously attributed MuddyWater to Iran’s Ministry of Intelligence and Security (MOIS) and described the group as targeting government and commercial organizations across Asia, Africa, Europe, and North America, including telecommunications, defense, local government, and oil and gas. Public reporting and government advisories say the group has used spearphishing, exploitation of known flaws such as CVE-2020-0688 and CVE-2020-1472, DLL side-loading, obfuscated PowerShell, and malware including PowGoop, Mori, Small Sieve, Canopy/Starwhale, and POWERSTATS to establish access, maintain persistence, exfiltrate data, and in some cases deploy ransomware.
