自动化接入 · API / MCP EN

组织档案 · G0069

MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.

ATT&CK G0069 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2018

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).1 Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. 2345678910111213

  1. CYBERCOM Iranian Intel Cyber January 2022
  2. FalconFeeds_Iran_Mar2026
  3. Huntio_IranInfra_Mar2026
  4. Unit 42 MuddyWater Nov 2017
  5. Symantec MuddyWater Dec 2018
  6. ClearSky MuddyWater Nov 2018
  7. ClearSky MuddyWater June 2019
  8. Reaqta MuddyWater November 2017
  9. DHS CISA AA22-055A MuddyWater February 2022
  10. Talos MuddyWater Jan 2022
  11. NaumaanProofpoint_GlobalClickFix_April2025
  12. ESET_MuddyWater_Dec2025
  13. SymantecCarbonBlack_Seedworm_Mar2026

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asMuddyWater— → …100src_mitre_attck_enterprise
also_known_asEarth Vetala— → …100src_mitre_attck_enterprise
also_known_asMERCURY— → …100src_mitre_attck_enterprise
also_known_asStatic Kitten— → …100src_mitre_attck_enterprise
also_known_asSeedworm— → …100src_mitre_attck_enterprise
also_known_asTEMP.Zagros— → …100src_mitre_attck_enterprise
also_known_asMango Sandstorm— → …100src_mitre_attck_enterprise
also_known_asTA450— → …100src_mitre_attck_enterprise
also_known_asMuddyKrill— → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1137.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0052018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0042018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472018 → …100src_mitre_attck_enterprise
uses_techniquetech_t15342018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0042018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1590.0042018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1559.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t15712018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0032018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0032018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0072018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0052018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10162018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t11402018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1559.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0102018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0042018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1518.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1074.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t11132018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t16852018 → …100src_mitre_attck_enterprise
uses_techniquetech_t15182018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10832018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1548.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t11052018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1573.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1567.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1555.0032018 → …100src_mitre_attck_enterprise
uses_techniquetech_t15662018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10492018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822018 → …100src_mitre_attck_enterprise
uses_techniquetech_t15552018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10572018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1132.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t11042018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10902018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0032018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1053.0052018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1090.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10332018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1102.0022018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1218.0112018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1552.0012018 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902018 → …100src_mitre_attck_enterprise
uses_techniquetech_t12102018 → …100src_mitre_attck_enterprise
uses_techniquetech_t12032018 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0052018 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1003.001LSASS Memory—
T1003.004LSA Secrets—
T1003.005Cached Domain Credentials—
T1016System Network Configuration Discovery—
T1027.003Steganography—
T1027.004Compile After Delivery—
T1027.010Command Obfuscation—
T1033System Owner/User Discovery—
T1036.005Match Legitimate Resource Name or Location—
T1041Exfiltration Over C2 Channel—
T1047Windows Management Instrumentation—
T1049System Network Connections Discovery—
T1053.005Scheduled Task—
T1057Process Discovery—
T1059.001PowerShell—
T1059.003Windows Command Shell—
T1059.005Visual Basic—
T1059.006Python—
T1059.007JavaScript—
T1071.001Web Protocols—
T1074.001Local Data Staging—
T1082System Information Discovery—
T1083File and Directory Discovery—
T1087.002Domain Account—
T1090Proxy—
T1090.002External Proxy—
T1102.002Bidirectional Communication—
T1104Multi-Stage Channels—
T1105Ingress Tool Transfer—
T1113Screen Capture—
T1132.001Standard Encoding—
T1137.001Office Template Macros—
T1140Deobfuscate/Decode Files or Information—
T1190Exploit Public-Facing Application—
T1203Exploitation for Client Execution—
T1204.001Malicious Link—
T1204.002Malicious File—
T1204.004Malicious Copy and Paste—
T1210Exploitation of Remote Services—
T1218.003CMSTP—
T1218.005Mshta—
T1218.011Rundll32—
T1219.002Remote Desktop Software—
T1518Software Discovery—
T1518.001Security Software Discovery—
T1534Internal Spearphishing—
T1547.001Registry Run Keys / Startup Folder—
T1548.002Bypass User Account Control—
T1552.001Credentials In Files—
T1555Credentials from Password Stores—
T1555.003Credentials from Web Browsers—
T1559.001Component Object Model—
T1559.002Dynamic Data Exchange—
T1560.001Archive via Utility—
T1566Phishing—
T1566.001Spearphishing Attachment—
T1566.002Spearphishing Link—
T1567.002Exfiltration to Cloud Storage—
T1571Non-Standard Port—
T1573.001Symmetric Cryptography—
T1574.001DLL—
T1583.001Domains—
T1583.006Web Services—
T1588.001Malware—
T1588.002Tool—
T1590.004Network Topology—
T1684.001Impersonation—
T1685Disable or Modify Tools—

别名

Earth Vetala · Mango Sandstorm · MERCURY · MuddyKrill · MuddyWater · Seedworm · Static Kitten · TA450 · TEMP.Zagros

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错