G006928 cited sources

MuddyWater

Also tracked as Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill

Techniques Mapped68

Tools & Malware21

Campaigns TrackedNone published

Last Updated (MITRE)Jul 31, 2026

Description (MITRE ATT&CK)

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.

Known Techniques by Tactic

Execution (14)

Associated Tools & Malware

MuddyViper (malware)STARWHALE (malware)LP-Notes (malware)POWERSTATS (malware)Rclone (tool)Out1 (tool)Tsundere Botnet (malware)PowerSploit (tool)Small Sieve (malware)Fooder

Regions Mentioned

AfricaIranSaudi ArabiaUnited Arab EmiratesMiddle EastEurope

Sectors Mentioned

GovernmentTelecommunications

Derived from MITRE ATT&CK's own description text for this group — not a confirmed, exhaustive targeting assessment.

Seraph Context

Organisational Relevance

Shown when this actor's known techniques match your monitored environment.

Exploited CVE Correlation

Surfaced when a technique used by this actor maps to a tracked CISA KEV entry.

Sector & Regional Signal

Derived from MITRE's own published description text, never asserted beyond it.

Watchlist

Signed-in customers can track this actor and be notified of profile updates.

Is this actor relevant to your environment?

Match this actor's known techniques against the technologies you run inside Seraph CTI, and get notified if their profile changes.

Explore Seraph CTI Back to Threat Actors

MuddyWater

Description (MITRE ATT&CK)

Known Techniques by Tactic

Execution (14)

Associated Tools & Malware

Regions Mentioned

Sectors Mentioned

Seraph Context

Organisational Relevance

Exploited CVE Correlation

Sector & Regional Signal

Watchlist

Other extensively documented threat actors.

Is this actor relevant to your environment?

Stealth (10)

Command And Control (10)

Discovery (9)

Credential Access (6)

Initial Access (4)

Resource Development (4)

Persistence (3)

Privilege Escalation (3)

Collection (3)

Lateral Movement (2)

Exfiltration (2)

Reconnaissance (1)

Defense Impairment (1)