MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).1 Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. 2345678910111213
- CYBERCOM Iranian Intel Cyber January 2022
- FalconFeeds_Iran_Mar2026
- Huntio_IranInfra_Mar2026
- Unit 42 MuddyWater Nov 2017
- Symantec MuddyWater Dec 2018
- ClearSky MuddyWater Nov 2018
- ClearSky MuddyWater June 2019
- Reaqta MuddyWater November 2017
- DHS CISA AA22-055A MuddyWater February 2022
- Talos MuddyWater Jan 2022
- NaumaanProofpoint_GlobalClickFix_April2025
- ESET_MuddyWater_Dec2025
- SymantecCarbonBlack_Seedworm_Mar2026
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1137.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1534 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1548.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1132.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1104 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.004 | LSA Secrets | — |
| T1003.005 | Cached Domain Credentials | — |
| T1016 | System Network Configuration Discovery | — |
| T1027.003 | Steganography | — |
| T1027.004 | Compile After Delivery | — |
| T1027.010 | Command Obfuscation | — |
| T1033 | System Owner/User Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.006 | Python | — |
| T1059.007 | JavaScript | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1090.002 | External Proxy | — |
| T1102.002 | Bidirectional Communication | — |
| T1104 | Multi-Stage Channels | — |
| T1105 | Ingress Tool Transfer | — |
| T1113 | Screen Capture | — |
| T1132.001 | Standard Encoding | — |
| T1137.001 | Office Template Macros | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1204.004 | Malicious Copy and Paste | — |
| T1210 | Exploitation of Remote Services | — |
| T1218.003 | CMSTP | — |
| T1218.005 | Mshta | — |
| T1218.011 | Rundll32 | — |
| T1219.002 | Remote Desktop Software | — |
| T1518 | Software Discovery | — |
| T1518.001 | Security Software Discovery | — |
| T1534 | Internal Spearphishing | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1548.002 | Bypass User Account Control | — |
| T1552.001 | Credentials In Files | — |
| T1555 | Credentials from Password Stores | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1559.001 | Component Object Model | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1560.001 | Archive via Utility | — |
| T1566 | Phishing | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1571 | Non-Standard Port | — |
| T1573.001 | Symmetric Cryptography | — |
| T1574.001 | DLL | — |
| T1583.001 | Domains | — |
| T1583.006 | Web Services | — |
| T1588.001 | Malware | — |
| T1588.002 | Tool | — |
| T1590.004 | Network Topology | — |
| T1684.001 | Impersonation | — |
| T1685 | Disable or Modify Tools | — |
别名
Earth Vetala · Mango Sandstorm · MERCURY · MuddyKrill · MuddyWater · Seedworm · Static Kitten · TA450 · TEMP.Zagros
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。