MuddyWater

▲ High Threat Iran

Primary Aliases: Mango Sandstorm Static Kitten ATK51 Boggy Serpens

Sponsor / State Affiliation Iran (Islamic Republic of)

Primary Motivation Espionage

Active Timeline Unknown – Present

Confidence Rating 70% (Grounded)

The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.

⚔️ Weaponized CVE Matrix (2)

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Government Telecom Defense Energy Middle East / Europe

🛡️ MITRE ATT&CK® Attack Lifecycle (68 TTPs)

📥 Download Navigator JSON

Initial Access 5

T1566 Spearphishing Link

T1566 Internal Spearphishing

T1566 Spearphishing Attachment

T1566 Exploit Public-Facing Application

Execution 5

T1059 Windows Command Shell

T1059 Scheduled Task

T1059 PowerShell

T1059 Exploitation for Client Execution

Persistence & Privilege Escalation 1

T1547 Registry Run Keys / Startup Folder

Defense Evasion 1

T1027 Command Obfuscation

Credential Access & Discovery 12

T1003 System Network Configuration Discovery

T1003 Security Software Discovery

T1003 Software Discovery

T1003 File and Directory Discovery

T1003 Credentials from Web Browsers

T1003 System Network Connections Discovery

T1003 System Information Discovery

T1003 Credentials from Password Stores

T1003 Process Discovery

T1003 System Owner/User Discovery

T1003 Credentials In Files

T1003 Cached Domain Credentials

Lateral Movement & Collection 3

T1021 Local Data Staging

T1021 Screen Capture

T1021 Remote Desktop Software

Command & Control 4

T1071 Web Protocols

T1071 Ingress Tool Transfer

T1071 Exfiltration to Cloud Storage

T1071 Exfiltration Over C2 Channel

Operational Techniques 37

T1000 Office Template Macros

T1000 Malicious Copy and Paste

T1000 Windows Management Instrumentation

T1000 LSA Secrets

T1000 Network Topology

T1000 Component Object Model

T1000 Non-Standard Port

T1000 Match Legitimate Resource Name or Location

T1000 Domain Account

T1000 JavaScript

T1000 Web Services

T1000 Visual Basic

T1000 Deobfuscate/Decode Files or Information

T1000 Dynamic Data Exchange

T1000 Compile After Delivery

T1000 Disable or Modify Tools

T1000 Bypass User Account Control

T1000 Symmetric Cryptography

T1000 Archive via Utility

T1000 Impersonation

T1000 Standard Encoding

T1000 Multi-Stage Channels

T1000 Malicious Link

T1000 Steganography

T1000 LSASS Memory

T1000 External Proxy

T1000 Malicious File

T1000 Bidirectional Communication

T1000 Exploitation of Remote Services

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Cavern Manticore Exploiting SysAid via Modular Cavern C2 Framework

Attacks and Vulnerabilities 2026-07-08

[DEEP DIVE] Iranian APT Escalation: Massive Surge in Cyber Operations Against Israeli Infrastructure

Attacks and Vulnerabilities 2026-07-06

[DEEP DIVE] Iran-Linked MuddyWater Actors Compromising Rockwell Automation PLCs in U.S. Critical Infrastructure

Attacks and Vulnerabilities 2026-06-07

Copied to clipboard

LINK COPIED TO CLIPBOARD