APT groups are persistent, often state-funded teams that run targeted cyber-espionage operations against governments, critical infrastructure and strategic industries. This post profiles five that are active in the Middle East and North Africa (MENA): MuddyWater, OilRig, Moses Staff, APT33 and SideWinder. It describes who each one targets and how it works.
Which APT Groups Are Notable in the MENA Region?
Advanced Persistent Threat (APT) groups, or state-sponsored organizations, conduct persistent and targeted cyber-espionage operations. They are often state-funded and have high levels of skill and resources, and they carry out complex attacks.
Their main interests are critical infrastructure, government agencies, and strategic industries that matter for intelligence collection. Examples are military and national security matters, assessments of national assets, operational disruption, and geopolitical advantage.
The Middle East and North Africa (MENA) present a particular APT challenge. The region is of strategic interest, and operations there happen at several levels and often reach far beyond domestic borders. Below is an outline of five groups that have had a significant and persistent presence, shown through high-profile operations.
MuddyWater
MuddyWater, active since 2017 and tied to Iranian intelligence, has consistently targeted telecommunications, energy, and government networks. The group’s tactics often involve spear-phishing, PowerShell-based malware, and the misuse of legitimate administrative tools. It uses them to stay on the network and steal data.
One of its most prominent campaigns occurred in 2024 against Israeli organizations. During this campaign, MuddyWater deployed a new backdoor called BugSleep. It relied on a C2 (command & control) infrastructure called “DarkBeatC2.”
The operation began with phishing emails that had malicious attachments. The attackers used living-off-the-land techniques to blend in with legitimate network activity. Once on the network, they established persistence and elevated privileges before exfiltrating sensitive data. The campaign showed MuddyWater’s ever-evolving toolset. It also showed the group’s continued role in carrying out Iran’s geopolitical objectives to undermine Israel’s national security.
OilRig (APT34)
OilRig has been active since at least 2014 and is another widely known espionage unit that is thought to be linked to Iran’s political agenda. OilRig campaigns mainly target the finance, energy, telecom, and government sectors. It uses spear-phishing, malicious macros, or custom-built backdoors to achieve a long-term presence.
A high-profile campaign associated with OilRig began in 2018 and was called “Out to Sea.” The operation lasted several years and targeted diplomatic organizations, healthcare organizations, and technology companies in the region. Attackers were able to deploy several backdoors (e.g., DanBot, Shark, and Milan) before moving to a more sophisticated tool called Marlin. Uniquely, Marlin leveraged Microsoft OneDrive as its command-and-control channel which made detection far more difficult. The campaign let OilRig harvest sensitive diplomatic and healthcare data. It showed the group’s alignment with Iran’s regional political goals and its ability to innovate despite countermeasures.
Moses Staff
Moses Staff began publicly engaging in campaigns in late 2021 employing an unusual combination of tactics that made it difficult to categorize. Much of the activity blurs the boundaries between ransomware and hack-and-leak campaigns. Nonetheless, acting in an atypical manner, Moses Staff does not demand payment. Instead, the group encrypts systems and steals data in order to release data publicly and cause reputational and operational harm.
Another Iran-linked hack-and-leak case, attributed by the FBI to Emennet Pasargad, is covered in Emennet Pasargad hack-and-leak and information operations against Israel.
One of the group’s earlier incidents of high visibility involved Israeli companies. Attackers accessed corporate networks, encrypted servers, and exfiltrated sensitive business information, which they publicly leaked in an effort to humiliate the victim companies. The attackers included propaganda messages with the leaks, framing the attack as a form of resistance rather than motivated solely by profit. This caused disruptions for the firm, while also creating a propaganda effect that fueled political tensions. This type of action positioned Moses Staff as a destructive actor intent on undermining their regional rivals.
APT33 (Elfin)
APT33 (Elfin) is one of Iran’s better-known cyber threat groups, which is state-sponsored. The group has been active since as early as 2013. APT33’s activities have generally been applied against energy, aviation, and defense industries – primarily in Saudi Arabia. It has a known history of leveraging custom malware to breach industrial systems, including disruption of business processes that are linked to national security.
In approximately 2017, APT33 launched a campaign targeting multiple Saudi petrochemicals and aviation companies. Attackers appear to have used several malware families, including DROPSHOT and the TURNEDUP backdoor. These provide remote access and persistence, and they can add further backdoors, among other features. Evidence also connected this actor to destructive malware, such as StoneDrill, which lets attackers wipe systems and disrupt industrial processes.
The campaign showed that the group could do more than steal sensitive information. It could cause physical and operational disruption to critical sectors of Saudi Arabia’s economy and defense posture.
- 2013APT33 (Elfin)Active since as early as 2013.
- 2014OilRigActive since at least 2014.
- 2017MuddyWaterActive since 2017, tied to Iranian intelligence.
- Late 2021Moses StaffBegan publicly engaging in campaigns.
SideWinder
Over the past few years, SideWinder (associated with India) broadened its activities beyond South Asia to include the MENA region. Its campaigns typically use these methods to deliver the tools that support its espionage:
- Phishing emails
- Outdated Office vulnerabilities
- Multi-stage malware loaders
In 2024, SideWinder was linked to an espionage campaign targeting ports and maritime facilities in select countries strategically important to India including Egypt, Bangladesh, and Sri Lanka. In Egypt, SideWinder sent targeted phishing emails to employees of port authorities and logistics firms. This gave it access to the systems that support maritime trade and operations.
SideWinder then deployed multi-stage malware that could exfiltrate sensitive documents and monitor internal communications. The campaign showed that SideWinder treats maritime (port and navigation) infrastructure as a strategic intelligence target. It also points to the growing role of maritime security and risk in shaping regional security.
| Group | Main targets | Methods |
|---|---|---|
| MuddyWater | Telecommunications, energy and government networks | Spear-phishing, PowerShell-based malware, legitimate admin tools |
| OilRig | Finance, energy, telecom and government sectors | Spear-phishing, malicious macros, custom built backdoors |
| Moses Staff | Israeli companies | Encrypts systems, steals data and leaks it publicly, no payment demand |
| APT33 | Energy, aviation and defense industries, primarily in Saudi Arabia | Custom malware, including DROPSHOT, TURNEDUP and StoneDrill |
| SideWinder | Ports and maritime facilities in 2024 | Phishing emails, outdated Office vulnerabilities, multi-stage malware loaders |
How Did Activity Escalate During the Iran-Israel Conflict?
The recent conflict between Iran and Israel has only highlighted the role of APT groups. Security researchers noticed a massive increase in activity from Iranian-backed actors during and immediately after the escalation.
MuddyWater, for example, was linked to a new Android surveillance tool called DCHSpy. It extracts WhatsApp messages, SMS, call logs, and GPS location. It can also let someone start the camera or microphone. This surfaced less than a week after the start of the conflict, indicating that Iranian APTs can mobilize cyber assets quickly alongside conventional warfare.
Meanwhile, reporting showed that other Iranian-linked groups such as OilRig and APT33 had increased their overall activity. Some reporting suggested an increase in attempts as high as 130% during this escalation.
The targets were not only Israeli entities but also allied entities in the U.S., with a focus on parts of the transport and manufacturing industries. The activity also shows that in a geopolitical crisis, events turn into cyber activity at once. State-led APTs act as instruments of the state to support national interest.
Conclusion
The actions of MuddyWater, OilRig, Moses Staff, APT33, and SideWinder show how varied and persistent the threat landscape is for defenders in the MENA region. These groups use different tools and techniques. They share a focus on strategic infrastructure, including energy, petrochemicals, state systems, and port logistics, which shows the scale of the challenge.
The recent rise in activity during the Iran–Israel conflict also shows that these actors do not stand still. They quickly adapt their focus to geopolitical circumstances. These campaigns show how a state can use cyber capabilities as an extension of its power.
For defenders, the lesson is clear. Professionals need to build technical resilience and also stay aware of the broader political context in which these groups operate.
For the Handala persona that MITRE assesses to act for Iran’s MOIS, see our Handala threat group profile. It covers the 2026 US Department of Justice and FBI statements and how the group works.