MuddyWater

MuddyWater is an Iranian state-linked cyber espionage threat actor widely associated with Iran’s Ministry of Intelligence and Security (MOIS). It is tracked under numerous aliases including Seedworm, Static Kitten, MERCURY, Mango Sandstorm, Boggy Serpens, TA450, TEMP.Zagros, Earth Vetala, Yellow Nix, ITG17, and G0069. The group has been active since at least 2017 and is known for long-running intelligence collection, access development, and strategic pre-positioning operations rather than primarily destructive or financially motivated activity. MuddyWater has targeted government, defense, telecommunications, energy, financial, nonprofit, transportation, aerospace, and technology organizations across the Middle East, Israel, Iraq, Europe, and North America, including the United States and Canada. Reporting in 2026 linked the group to intrusions affecting a U.S. financial institution, a U.S. airport, nonprofits, and the Israeli operation of a U.S. software supplier serving defense and aerospace customers. The actor’s operational pattern is consistent with espionage and persistence-building intended to preserve future options for intelligence collection, coercion, selective disruption, or downstream access. The group is known for pragmatic tradecraft that blends custom malware with commodity tooling and legitimate services. MuddyWater has historically relied on spearphishing, including malicious Office documents and macro-enabled lures, compromised mailboxes, and more recent social-engineering approaches using collaboration platforms and recruitment-themed impersonation. It frequently abuses PowerShell and other scripting environments, DLL sideloading, remote management and monitoring tools, cloud storage, and trusted web services to reduce signature-based detection opportunities. Observed persistence mechanisms include Registry Run keys and Startup-related autostart methods. Malware and tooling associated with MuddyWater include Dindoor, Fakeset, PowGoop, Small Sieve, Mori, POWERSTATS, Canopy or Starwhale, MuddyViper, GhostBackDoor, Stagecomp, Darkcomp, CHAR, GhostFetch, HTTP_VIP, RustyWater, and ZionSiphon. Recent reporting also described use of Deno-based and Python-based implants, Rust-based payloads, Telegram-backed command channels, reflective loading, cloud-based exfiltration, and attempts to blend command-and-control and staging into legitimate enterprise traffic. The group has also been linked to use of commodity and criminal-ecosystem tooling, including remote administration software and malware-as-a-service components such as CastleRAT and ChainShell. In some cases, MuddyWater activity has reportedly leveraged ransomware or ransomware-branded operations, including Chaos, as cover for espionage objectives. Operationally, MuddyWater commonly employs spearphishing attachment and link delivery, user execution, command and scripting interpreters, ingress tool transfer, valid accounts, exfiltration over web services, and application-layer command-and-control. The actor has also demonstrated low-signature tradecraft through use of legitimate cloud platforms, commercial storage providers, and dual-use administration tools, reflecting a broader shift toward behaviorally stealthy operations that minimize reliance on easily blocked attacker-controlled infrastructure. MuddyWater is best understood as a persistent MOIS-aligned espionage and access-enablement actor within the broader Iranian cyber ecosystem. Public reporting also notes technical or operational overlaps between MuddyWater and other Iran-nexus clusters, including Lyceum and Cavern Manticore, though such overlaps do not always establish direct equivalence. Its campaigns consistently emphasize durable footholds, credential access, internal reconnaissance, and covert data theft in support of Iranian strategic intelligence requirements.