MuddyWater (hacker group)

MuddyWater

Formation	2017
Type	Advanced persistent threat group
Location	Iran
Methods	Spear-phishing, exploitation of public vulnerabilities, living off the land, abuse of remote monitoring and management tools, custom malware, destructive attacks
Affiliations	Iranian Ministry of Intelligence and Security

MuddyWater is an Iranian cyberespionage and advanced persistent threat (APT) group that is widely considered to be part of, or subordinate to, the Iranian Ministry of Intelligence and Security (MOIS).

First publicly identified in 2017, it has targeted government agencies, telecommunications operators, defense organizations, universities, oil and gas companies, across the Middle East, Asia, Europe, Africa, and North America. MuddyWater is known for spear-phishing, exploiting exposed internet-facing systems, and combining custom implants with legitimate administrative tools in order to maintain long-term access to victim networks.

Characteristics

MuddyWater is an Iranian state-backed espionage group tracked under numerous aliases, including Seedworm, Static Kitten, TEMP.Zagros, Earth Vetala, MERCURY, Mango Sandstorm, TA450, and Boggy Serpens. The name "MuddyWater" was coined by Palo Alto Networks in 2017 because the group's early campaigns were difficult to attribute and were often confused with other intrusion sets.

The group has relied heavily on spear-phishing and the exploitation of publicly known vulnerabilities in internet-facing servers. It has also made extensive use of "living off the land" techniques, PowerShell-based tooling, and legitimate remote monitoring and management software such as ScreenConnect, SimpleHelp, and Atera to avoid detection. Other deception measures include the use of false flags and the impersonation of other threat actors.

History

2017–2022

The cluster later known as MuddyWater was publicly documented in November 2017 after campaigns that had run between February and October of that year hit organizations in Saudi Arabia, Iraq, Israel, the United Arab Emirates, Georgia, India, Pakistan, Turkey, and the United States. Early campaigns used malicious documents and PowerShell payloads such as POWERSTATS, and were notable for region-specific decoy files designed to resemble communications from local government institutions.

By 2018, the group had expanded its victimology across the Middle East, Europe and North America and had compromised more than 130 victims in 30 organizations by the September of that year alone. The group used custom backdoors such as Powermud and Powemuddy alongside open-source tools including LaZagne and CrackMapExec to steal credentials and move laterally within compromised networks.

In 2020 and 2021, further activity linked to the group was reported against government, telecom and IT services organizations in Iraq, Turkey, Kuwait, the United Arab Emirates, Georgia, Israel, Jordan, Saudi Arabia, Pakistan, Thailand and Laos. These operations relied on backdoors such as Mori, credential theft, web shells, tunnelling tools and a growing mix of custom malware and legitimate administrative software.

In September 2021, the United States Department of the Treasury mentioned MuddyWater when sanctioning MOIS and Iran's intelligence minister for malign cyber activity. In February 2022, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), United States Cyber Command's Cyber National Mission Force and the United Kingdom's National Cyber Security Centre issued a joint advisory and formally described MuddyWater as an Iranian government-sponsored actor and a subordinate element within MOIS.

2023

In February 2023, Israel's National Cyber Directorate attributed the disruptive cyberattack on the Technion – Israel Institute of Technology to MuddyWater, saying the operation had been carried out under the false ransomware persona "DarkBit". Microsoft later said that MuddyWater, which it tracks as MERCURY and later Mango Sandstorm, worked with a separate cluster it called DEV-1084 in destructive attacks that hit both on-premises and cloud environments, and assessed that the attackers had attempted to disguise the activity as ordinary ransomware.

2024

MuddyWater increased its activity against Israeli targets after the start of the Israel–Hamas war. In campaigns observed in March and April 2024, the group used compromised email accounts and PDF files containing embedded links to deliver malicious archives and remote monitoring tools to Israeli employees at multinational firms. During this period, MuddyWater had expanded its use of legitimate remote monitoring and management software, especially Atera Agent and ScreenConnect, and had also begun deploying a custom backdoor dubbed BugSleep against organizations in Israel. The group distributed these tools through compromised organizational accounts and file-sharing services such as Egnyte, Onehub, Sync and TeraBox.

2025

In October 2025, MuddyWater started a phishing campaign that used a compromised mailbox to send malicious Microsoft Word documents across the Middle East and North Africa. It targeted more than 100 government entities and deployed a custom backdoor called Phoenix.

2026

In February 2026, Group-IB disclosed "Operation Olalampo", which it attributed to MuddyWater. The campaign targeted multiple organizations and individuals primarily in the Middle East and North Africa and used new malware families including CHAR, GhostFetch, HTTP_VIP and GhostBackDoor, with one variant communicating through a Telegram bot used for command and control.

Later in March 2026, the group further refined its operations through "trusted relationship" compromises, wider targeting of maritime, aviation and financial organizations, and newer malware written in Rust. Unit 42 also linked early 2025 operations to overlaps with Lyceum, an Iranian intrusion set associated with OilRig.

See also

• List of hacker groups
• Cyberwarfare and Iran
• APT35
• Helix Kitten