MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).1 Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. 2345678910111213
- CYBERCOM Iranian Intel Cyber January 2022
- FalconFeeds_Iran_Mar2026
- Huntio_IranInfra_Mar2026
- Unit 42 MuddyWater Nov 2017
- Symantec MuddyWater Dec 2018
- ClearSky MuddyWater Nov 2018
- ClearSky MuddyWater June 2019
- Reaqta MuddyWater November 2017
- DHS CISA AA22-055A MuddyWater February 2022
- Talos MuddyWater Jan 2022
- NaumaanProofpoint_GlobalClickFix_April2025
- ESET_MuddyWater_Dec2025
- SymantecCarbonBlack_Seedworm_Mar2026
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | MuddyWater | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Earth Vetala | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | MERCURY | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Static Kitten | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Seedworm | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TEMP.Zagros | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Mango Sandstorm | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | TA450 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | MuddyKrill | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1137.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1534 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1104 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.004 | LSA Secrets | — |
| T1003.005 | Cached Domain Credentials | — |
| T1016 | System Network Configuration Discovery | — |
| T1027.003 | Steganography | — |
| T1027.004 | Compile After Delivery | — |
| T1027.010 | Command Obfuscation | — |
| T1033 | System Owner/User Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1059.007 | JavaScript | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1090.002 | External Proxy | — |
| T1102.002 | Bidirectional Communication | — |
| T1104 | Multi-Stage Channels | — |
| T1105 | Ingress Tool Transfer | — |
| T1113 | Screen Capture | — |
| T1132.001 | Standard Encoding | — |
| T1137.001 | Office Template Macros | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1204.004 | Malicious Copy and Paste | — |
| T1210 | Exploitation of Remote Services | — |
| T1218.003 | CMSTP | — |
| T1218.005 | Mshta | — |
| T1218.011 | Rundll32 | — |
| T1219.002 | Remote Desktop Software | — |
| T1518 | Software Discovery | — |
| T1518.001 | Security Software Discovery | — |
| T1534 | Internal Spearphishing | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1552.001 | Credentials In Files | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1559.001 | Component Object Model | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1560.001 | Archive via Utility | — |
| T1566 | Phishing | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1571 | Non-Standard Port | — |
| T1573.001 | Symmetric Cryptography | — |
| T1574.001 | DLL | — |
| T1583.001 | Domains | — |
| T1583.006 | Web Services | — |
| T1588.001 | Malware | — |
| T1588.002 | Tool | — |
| T1590.004 | Network Topology | — |
| T1684.001 | Impersonation | — |
| T1685 | Disable or Modify Tools | — |
Aliases
Earth Vetala · Mango Sandstorm · MERCURY · MuddyKrill · MuddyWater · Seedworm · Static Kitten · TA450 · TEMP.Zagros
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.