MuddyWaterThreat actor
- atk51
- boggy serpens
- cobalt ulster
- earth vetala
- g0069
- mango sandstorm
- muddy ion
- muddycoast
- muddykrill
- Seedworm
- static kitten
- ta450
- temp.zagros
The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”.From MISP Galaxy
Last reported 26 days ago, by Risky Business News22 reports
ATT&CK techniques
6 of 60 · each with the sentence it comes from- T1684Social Engineering
“It does not replace manual testing for proprietary source code review, social engineering, or physical security assessments.”
- T1053.005Scheduled Task
“T1053.005”
- T1105Ingress Tool Transfer
“T1105”
- T1195Supply Chain Compromise
“When it comes to attacks that give bad actors a lot of bang for their buck, supply chain compromise typically reigns supreme.”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
22 reports · the newest 20, newest first · the exact sentence from each-
Risky Bulletin: Intel ends paid bug bounties“MuddyWater's rented arsenal: Iran-backed APT group MuddyWater has been renting tools from TAG-150, a Malware-as-a-Service platform run by Russian-speaking cybercriminals.”
-
Federal & Mission-Critical Security Validation“The flaw that enables full domain compromise and aligns directly with how Iranian groups like MuddyWater and Magic Hound operate.”
-
EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight“By March 2026, Iran-linked MuddyWater was using it, too.”
-
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions“Symantec first documented this technique in Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker.”
-
Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel“Read more on Iranian-linked cyber activity: Iran-Linked MuddyWater Poses as Ransomware Gang to Mask Cyber Espionage”
-
Wake-Up Call for CNI After Iranian Attack Shuts Down UK Power Plant“Read more on Iranian threats: Iran-Linked MuddyWater Poses as Ransomware Gang to Mask Cyber Espionage”
-
Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters“For example, activity attributed to the MOIS-linked Seedworm/MuddyWater cluster began in early February, before the opening strikes.”
-
The dual-use dilemma: Rethinking detection for remote access tool abuse“PDQ Connect is a newer, cloud-based RMM that has seen abuse from APT groups like MuddyWater.”
-
The evolution of the AI SOC: From Hype to Hyper“SOC dashboard showing a potential MuddyWater cyber intrusion detected by Sekoia.io platform with alerts, attack storyline, and incident context”
-
MuddyWater replaces Atera by custom MuddyRot implant“MuddyWater replaces Atera by custom MuddyRot implant”
-
El impacto en la ciberseguridad de la guerra en Irán: riesgos clave que debe monitorear“En particular, MuddyWater ha colaborado de cerca con Lyceum, un subgrupo de OilRig, y probablemente también ha actuado como initial access broker (IAB) para otros grupos iraníes.”
-
Cyber fallout from the Iran war: What to have on your radar“Notably, MuddyWater has worked closely with Lyceum, a subgroup of OilRig, as well as probably acted as an initial access broker (IAB) for other Iran-aligned groups.”
-
Unmasking an Attack Chain of MuddyWater“Unmasking an Attack Chain of MuddyWater”
-
Operation Olalampo: Inside MuddyWater’s Latest Campaign“Operation Olalampo: Inside MuddyWater’s Latest Campaign”
-
Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage“Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage”
-
Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025“Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025”
-
ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims“GROUP-IB has attributed a campaign to MuddyWater with moderate confidence.”
-
SimpleHarm: Tracking MuddyWater’s infrastructure“SimpleHarm: Tracking MuddyWater’s infrastructure”
-
“We find many things that others do not even see”“and identified a potential member of the attacking group known as MuddyWater.”
-
Catching fish in muddy waters“They disclosed information about APT groups affiliated with the Iranian government (OilRig and MuddyWater), including their tools, victims, and links.”
Indicators in its reports
named in the reports above- 162.0.230[.]185in 2 reports
- 40dead1e1d831076…5af71a9b5e05in 2 reports
- remotedesktop[.]comin 1 report
- syncroapi[.]comin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.