MuddyWater is a prolific Iranian MOIS-subordinate cyber-espionage group that has targeted government, telecom, defense, and energy organizations across the Middle East since 2017, with heavy focus on Gulf states and Israel.
MuddyWater first surfaced publicly in 2017 and was formally attributed by U.S. Cyber Command in January 2022 as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS). The group is assessed to function as one of Iran's most active regional espionage arms, blending intelligence collection with occasional access-brokering for other Iranian clusters.
Across its lifetime MuddyWater has favored living-off-the-land tradecraft: malicious documents with macro or lure content, PowerShell-based footholds, and heavy abuse of legitimate remote-management tools (Atera, ScreenConnect, Syncro, RemoteUtilities) for command-and-control and persistence. The group also runs custom implants and has repeatedly refreshed its C2 infrastructure, showing a preference for NameCheap-registered domains and specific hosting providers.
MENA targeting is central to MuddyWater's mission. Reporting consistently places victims in the UAE, Saudi Arabia, Israel, Turkey, Iraq, Jordan, and Egypt, spanning telecommunications, local government, finance, defense, and oil-and-gas sectors. CISA's AA22-055A advisory (February 2022) documented its Middle East and broader campaigns in detail.
The group remains highly active into 2025–2026. MITRE ATT&CK notes MuddyWater reusing domains dating to October 2025 and, in late 2025 and early 2026, adopting commercial satellite internet (Starlink) for C2 — an assessed attempt to complicate infrastructure tracking and network-based detection. ESET (December 2025) and Symantec/Carbon Black (March 2026, tracked as Seedworm) reported continued regional operations, and researchers have documented operational overlaps with the HEXANE/Lyceum cluster where MuddyWater likely acts as an initial-access broker.
| Technique | Name | Tactic | Observed use |
|---|---|---|---|
| T1113 ↗ | Screen Capture | collection | MuddyWater has used malware that can capture screenshots of the victim's machine. |
| T1560.001 ↗ | Archive Collected Data: Archive via Utility | collection | MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data. |
| T1074.001 ↗ | Data Staged: Local Data Staging | collection | MuddyWater has stored a decoy PDF file within a victim's %temp% folder. |
| T1573.001 ↗ | Encrypted Channel: Symmetric Cryptography | command and control | MuddyWater has used AES to encrypt C2 responses. |
| T1090 ↗ | Proxy | command and control | MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France. |
| T1571 ↗ | Non-Standard Port | command and control | MuddyWater has used ports 8043 and 8848 for botnet C2 communication. |
| T1071.001 ↗ | Application Layer Protocol: Web Protocols | command and control | MuddyWater has used HTTP for C2 communications. |
| T1132.001 ↗ | Data Encoding: Standard Encoding | command and control | MuddyWater has used tools to encode C2 communications including Base64 encoding. |
| T1105 ↗ | Ingress Tool Transfer | command and control | MuddyWater has used malware that can upload additional files to the victim's machine. MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim's machine. |
| T1102.002 ↗ | Web Service: Bidirectional Communication | command and control | MuddyWater has used web services including OneHub to distribute remote access tools. |
| T1104 ↗ | Multi-Stage Channels | command and control | MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back. |
| T1090.002 ↗ | Proxy: External Proxy | command and control | MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2). MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT). |
| T1219.002 ↗ | Remote Access Software: Remote Desktop Software | command and control | MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions. |
| T1003.004 ↗ | OS Credential Dumping: LSA Secrets | credential access | MuddyWater has performed credential dumping with LaZagne. |
| T1552.001 ↗ | Unsecured Credentials: Credentials In Files | credential access | MuddyWater has run a tool that steals passwords saved in victim email. |
| T1555 ↗ | Credentials from Password Stores | credential access | MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email. |
| T1555.003 ↗ | Credentials from Password Stores: Credentials from Web Browsers | credential access | MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers. |
| T1003.001 ↗ | OS Credential Dumping: LSASS Memory | credential access | MuddyWater has performed credential dumping with Mimikatz and procdump64.exe. |
| T1003.005 ↗ | OS Credential Dumping: Cached Domain Credentials | credential access | MuddyWater has performed credential dumping with LaZagne. |
| T1685 ↗ | Disable or Modify Tools | defense impairment | MuddyWater can disable the system's local proxy settings. |
| T1057 ↗ | Process Discovery | discovery | MuddyWater has used malware to obtain a list of running processes on the system. |
| T1518 ↗ | Software Discovery | discovery | MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine. |
| T1087.002 ↗ | Account Discovery: Domain Account | discovery | MuddyWater has used cmd.exe net user /domain to enumerate domain users. |
| T1083 ↗ | File and Directory Discovery | discovery | MuddyWater has used malware that checked if the ProgramData folder had folders or files with keywords 'Kasper,' 'Panda,' or 'ESET.' |
| T1082 ↗ | System Information Discovery | discovery | MuddyWater has used malware that can collect the victim's OS version and machine name. |
| T1033 ↗ | System Owner/User Discovery | discovery | MuddyWater has used malware that can collect the victim's username. |
| T1016 ↗ | System Network Configuration Discovery | discovery | MuddyWater has used malware to collect the victim's IP address and domain name. |
| T1518.001 ↗ | Software Discovery: Security Software Discovery | discovery | MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers. |
| T1049 ↗ | System Network Connections Discovery | discovery | MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine. |
| T1047 ↗ | Windows Management Instrumentation | execution | MuddyWater has used malware that leveraged WMI for execution and querying host information. |
| T1059.007 ↗ | Command and Scripting Interpreter: JavaScript | execution | MuddyWater has used JavaScript files to execute its POWERSTATS payload. |
| T1059.006 ↗ | Command and Scripting Interpreter: Python | execution | MuddyWater has developed tools in Python including Out1. |
| T1204.002 ↗ | User Execution: Malicious File | execution | MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro. |
| T1204.004 ↗ | User Execution: Malicious Copy and Paste | execution | MuddyWater has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code. |
| T1203 ↗ | Exploitation for Client Execution | execution | MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution. |
| T1204.001 ↗ | User Execution: Malicious Link | execution | MuddyWater has distributed URLs in phishing e-mails that link to lure documents. |
| T1559.002 ↗ | Inter-Process Communication: Dynamic Data Exchange | execution | MuddyWater has used malware that can execute PowerShell scripts via DDE. |
| T1559.001 ↗ | Inter-Process Communication: Component Object Model | execution | MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook. |
| T1059.005 ↗ | Command and Scripting Interpreter: Visual Basic | execution | MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros. |
| T1059.003 ↗ | Command and Scripting Interpreter: Windows Command Shell | execution | MuddyWater has used a custom tool for creating reverse shells. |
| T1059.001 ↗ | Command and Scripting Interpreter: PowerShell | execution | MuddyWater has used PowerShell for execution. |
| T1053.005 ↗ | Scheduled Task/Job: Scheduled Task | execution, persistence, privilege escalation | MuddyWater has used scheduled tasks to establish persistence. |
| T1574.001 ↗ | Hijack Execution Flow: DLL | execution, stealth | MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware. |
| T1041 ↗ | Exfiltration Over C2 Channel | exfiltration | MuddyWater has used C2 infrastructure to receive exfiltrated data. |
| T1567.002 ↗ | Exfiltration Over Web Service: Exfiltration to Cloud Storage | exfiltration | MuddyWater has attempted to exfiltrate data to Wasabi, a cloud storage service, using Rclone. |
| T1566.002 ↗ | Phishing: Spearphishing Link | initial access | MuddyWater has sent targeted spearphishing e-mails with malicious links. |
| T1566 ↗ | Phishing | initial access | MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com. |
| T1566.001 ↗ | Phishing: Spearphishing Attachment | initial access | MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload. |
| T1190 ↗ | Exploit Public-Facing Application | initial access | MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688). |
| T1534 ↗ | Internal Spearphishing | lateral movement | MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails. |
| T1210 ↗ | Exploitation of Remote Services | lateral movement | MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472). |
| T1137.001 ↗ | Office Application Startup: Office Template Macros | persistence | MuddyWater has used a Word Template, Normal.dotm, for persistence. |
| T1547.001 ↗ | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | persistence, privilege escalation | MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence. |
| T1548.002 ↗ | Abuse Elevation Control Mechanism: Bypass User Account Control | privilege escalation | MuddyWater uses various techniques to bypass UAC. |
| T1590.004 ↗ | Gather Victim Network Information: Network Topology | reconnaissance | MuddyWater has mapped target networks; access to this information and more is then shared/sold to other Iran threat actors. |
| T1583.006 ↗ | Acquire Infrastructure: Web Services | resource development | MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools. |
| T1588.002 ↗ | Obtain Capabilities: Tool | resource development | MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment. |
| T1588.001 ↗ | Obtain Capabilities: Malware | resource development | MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals. |
| T1583.001 ↗ | Acquire Infrastructure: Domains | resource development | MuddyWater has established domains, some of which appeared to spoof legitimate domains for use in operations. |
| T1027.004 ↗ | Obfuscated Files or Information: Compile After Delivery | stealth | MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code. |
| T1218.011 ↗ | System Binary Proxy Execution: Rundll32 | stealth | MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll. |
| T1027.010 ↗ | Obfuscated Files or Information: Command Obfuscation | stealth | MuddyWater has used Daniel Bohannon's Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands. |
| T1140 ↗ | Deobfuscate/Decode Files or Information | stealth | MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript. |
| T1218.003 ↗ | System Binary Proxy Execution: CMSTP | stealth | MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload. |
| T1036.005 ↗ | Masquerading: Match Legitimate Resource Name or Location | stealth | MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender. |
| T1218.005 ↗ | System Binary Proxy Execution: Mshta | stealth | MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution. |
| T1684.001 ↗ | Social Engineering for Impact: Impersonation | stealth | MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft. MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan. |
| T1027.003 ↗ | Obfuscated Files or Information: Steganography | stealth | MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg. |