MuddyWater

Overview

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.

Targets

Government

Regions

Georgia · India · Iraq · Israel · Pakistan · Saudi Arabia · Turkey · United Arab Emirates · United States

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190, T1203
• Custom malware/implant development — ATT&CK: 11 attributed custom malware families

TTPs — 68 techniques across 14 tactics

Tools & malware (21)

MuddyViper · STARWHALE · LP-Notes · POWERSTATS · Rclone · Out1 · Tsundere Botnet · PowerSploit · Small Sieve · Fooder · Mori · Mimikatz · LaZagne · PowGoop · CrackMapExec · ConnectWise · SHARPSTATS · Empire · RustyWater · RemoteUtilities · Koadic

Reporting (3)

• The Digital Redoubt: Iran’s National Information Network and the Asymmetry of Modern Cyber Conflict — FalconFeeds.io
• Seedworm: Iranian APT on Networks of U.S. Bank, Airport, Software Company — Threat Hunter Team
• Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation — Hunt.io