MuddyWater
MuddyWater is classified as state-sponsored.
- Malware families
- 13
- Suspected state sponsor
- Iran
- Also known as
- 13
The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.
The group is suspected of operating with the support of Iran.
The group is associated with 13 malware families.
Also known as: TEMP.Zagros, Static Kitten, Seedworm, MERCURY, COBALT ULSTER, G0069, ATK51, Boggy Serpens, Mango Sandstorm, TA450, Earth Vetala, MUDDYCOAST, MUDDY ION
The group is associated with 13 malware families.
Malware families
- Covicli
- DCHSpy
- GRAMDOOR
- MoriAgent
- MuddyC2Go
- Mudwater
- PhonyC2
- POWERSTATS
- PowGoop
- SHARPSTATS
- STARWHALE
- Tsundere
- Unidentified VBS 004 (RAT)
Published reports on this actor:
- https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/
- https://www.cfr.org/interactive/cyber-operations/muddywater
- https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.