NEW: Group Profiler — instant APT intel lookup.Try it →
Emblem illustrating the MuddyWater threat group

MuddyWater

G0069IranEspionageMITRE ATT&CK →

Also known as:Earth Vetala · MERCURY · Static Kitten · Seedworm · TEMP.Zagros · Mango Sandstorm · TA450 · MuddyKrill

Overview

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.

Naming & attribution

MuddyWater is tracked under 9 names across the industry. It uses 68 documented ATT&CK techniques — more than 93% of the 174 groups tracked here. Activity attributed since at least 2017.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
NameFirst reported by
Earth VetalaPeretz, A. and Theck, E
MERCURYMele, G. et al
Static KittenMele, G. et al
SeedwormSymantec DeepSight Adversary Intelligence Team
TEMP.ZagrosSingh, S. et al.
Mango SandstormMicrosoft
TA450Miller, J. et al
MuddyKrillCloudflare
MuddyWaterLancaster, T.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

  • T1137.001 Office Template Macros — used by 1 of 174 groups
  • T1218.003 CMSTP — used by 2 of 174 groups
  • T1204.004 Malicious Copy and Paste — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

  • Earth Lusca China — 29 shared techniques (35% overlap)
  • BRONZE BUTLER China — 26 shared techniques (32% overlap)
  • Sidewinder India — 24 shared techniques (32% overlap)
  • Gamaredon Group Russia — 33 shared techniques (31% overlap)
  • Mustang Panda China — 35 shared techniques (30% overlap)
  • FIN7 — 31 shared techniques (30% overlap)

Malware families with tracked indicators

2 families attributed to MuddyWater, with 1,186 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

  • ConnectWise1,120 indicators
  • Koadic66 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Targets

Government

Regions

Georgia · India · Iraq · Israel · Pakistan · Saudi Arabia · Turkey · United Arab Emirates · United States

Capabilities

  • Exploitation of public-facing / client applications — ATT&CK T1190, T1203
  • Custom malware/implant development — ATT&CK: 11 attributed custom malware families

TTPs — 68 techniques across 14 tactics

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Tools & malware (21)

MuddyViper · STARWHALE · LP-Notes · POWERSTATS · Rclone · Out1 · Tsundere Botnet · PowerSploit · Small Sieve · Fooder · Mori · Mimikatz · LaZagne · PowGoop · CrackMapExec · ConnectWise · SHARPSTATS · Empire · RustyWater · RemoteUtilities · Koadic

Reporting (3)

Need the matrix overlay, mind-map, or technique-flow view? Open the interactive Group Profilerin a browser with JavaScript enabled.