MuddyWater

G00696 reports

aliases · MuddyWater · Earth Vetala · MERCURY · Static Kitten · Seedworm · TEMP.Zagros · Mango Sandstorm · TA450 · MuddyKrill

Reports

Techniques

Tactics

Countries

35%

Hunt coverage

Aliases

Analyst assessment — key judgments

Signature techniques: T1589.001 (Credentials), T1588.006 (Vulnerabilities), T1684.001 (Impersonation).
Primary targeting: IR, US, RU, IL.
Steady activity: 1 report(s) in last 30d vs 1 prior (+0%).
Recent movement: 65 new technique(s), 128 new infrastructure indicator(s) in the last 30 days.
Hunt coverage 35% of 83 observed techniques (54 gap(s)).
Assessment confidence: medium (61).

Activity & trend

SteadyLast 30d: 1 vs 1 prior (+0%)· first reported 2026-06-08 · last 2026-09-11

30d

90d

All

0.4

Rpts/wk

Reporting timeline · 12 months

Movement — last 30 days

New techniques

T1053.005T1047T1113T1033T1132.001T1027.009T1027.013T1590.005T1059.007T1539T1036.005T1036.008

Dropped (90d+)

T1543.003T1195

Targeting gained

BRKRRUUS

New infrastructure

106eac79396a3ff77b8f375c391260ce422be2ae5ece7fd3766b0b7f8aadefa562313cea6c3c94f9c8c38634dd44d7c6162c66174a6ee23ee4042651223be3f8648bf6998c4a58b972522e5fda8d9d0aba80216c960977fa45e317f00dcf31e96acab299cb15cbf3f01a92e609e4c2bc26155e667e96c5d0170dffb37e05f525f735bc9ad84b3908a488f7ce42a3e2bb135fb46b11b127f45a266b3a4d9dff4a5c92d3b8734b4f498752f735a1ca0987f9e95a1e1fa3f3aebfc802c6c8e6a2eb87b76a60ba7c474dbf8f689df2808e1a5f109e7bb3df4dea81946f2f853da288

Vulnerabilities in this actor's reporting · 4

Overview

Analyst triage

Intelligence summary

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. (Citation: FalconFeeds_Iran_Mar2026)(Citation: Huntio_IranInfra_Mar2026)(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)(Citation: ESET_MuddyWater_Dec2025)(Citation: SymantecCarbonBlack_Seedworm_Mar2026)

Top co-occurring indicators

Aliases & naming

Targeting · countries

Targeting · named victims

ATT&CK technique matrix

Coverage vs hunt library:

—

Hunt-coverage gaps — prioritized

Top techniques by observation

T1589.001 · Credentialsconf 755
evidence: The extension you never installed: KREMLIN forges Chrome's own integri Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict
T1588.006 · Vulnerabilitiesconf 704
evidence: Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1684.001 · Impersonationconf 703
evidence: The extension you never installed: KREMLIN forges Chrome's own integri Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters 8th June – Threat Intelligence Report
AML.T0073 · Impersonationconf 703
evidence: The extension you never installed: KREMLIN forges Chrome's own integri Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters 8th June – Threat Intelligence Report
T1684 · Social Engineeringconf 703
evidence: The extension you never installed: KREMLIN forges Chrome's own integri Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict
T1027.003 · Steganographyconf 652
evidence: The extension you never installed: KREMLIN forges Chrome's own integri Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1001.002 · Steganographyconf 652
evidence: The extension you never installed: KREMLIN forges Chrome's own integri Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1204.002 · Malicious Fileconf 652
evidence: The extension you never installed: KREMLIN forges Chrome's own integri Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
T1593.001 · Social Mediaconf 652
evidence: The extension you never installed: KREMLIN forges Chrome's own integri AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict
T1069.001 · Local Groupsconf 601
evidence: Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
T1543.003 · Windows Serviceconf 601
evidence: 8th June – Threat Intelligence Report
T1195 · Supply Chain Compromiseconf 601
evidence: 8th June – Threat Intelligence Report

Threat catalogue · engineering roadmap0

Flagged detection-engineering queue

Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

Infrastructure

IOC type mix

Tooling / malware families

Relationships

Activity

30-day mention timeline

Recent reporting

Title	Source	Severity	Collected