Log in Request a demo

Threat group profile

MuddyWater

Also known as Earth Vetala, MERCURY, Static Kitten

MITRE ATT&CK, the FBI, CISA, NCSC-UK and the US Treasury attribute this group to Iran's Ministry of Intelligence and Security (MOIS).

In short

MITRE ATT&CK, the FBI, CISA, NCSC-UK and the US Treasury attribute this group to Iran's Ministry of Intelligence and Security (MOIS). It is described as running cyber espionage against telecommunications, defense, local government and oil and gas organizations. The 2022 joint advisory says it gets in by spearphishing and known software flaws. It says the group shares access with other actors.

Last updated 9 October 2026

Profile MapThreat Group
  1. Attributed OriginIran
  2. Names9names in public reportsMuddyWater · Earth Vetala · MERCURY
  3. Sectors9named as targetsEnergy organizations · Financial organizations · Email targets
  4. Techniques13in the attack chainResource Development · Initial Access · Execution
  5. Tools9tools and malware listedPOWERSTATS · PowGoop · Small Sieve

In one minute

Who they are
MITRE ATT&CK describes MuddyWater as a cyber espionage group. It says the group is assessed to be part of Iran's Ministry of Intelligence and Security (MOIS). The FBI, CISA, CNMF and NCSC-UK said so in advisory AA22-055A on 24 February 2022. The US Treasury repeated it on 9 September 2022.
Who they target
Government and private organizations in Asia, Africa, Europe and North America. The sectors are telecommunications, defense, local government, and oil and natural gas. MITRE adds finance, the UAE and Saudi Arabia.
How they usually get in
Spearphishing emails with attachments or links, including from compromised third-party accounts. It also uses known flaws such as Exchange CVE-2020-0688 and Netlogon CVE-2020-1472.
What stands out
The advisory says the group can pass stolen data and access to the Iranian government. It says the group can share them with other malicious actors. It also says the group deploys ransomware. MITRE says it uses legitimate remote management tools. It says that in late 2025 and early 2026 it used satellite internet for command and control.
What to do first
The advisory advises three steps. Patch known exploited flaws on mail and domain servers. Require multifactor authentication for webmail and VPN. Train staff to report phishing.

Names

Public reports use several names for this activity.

Names used for MuddyWater
NameWhere it appears
MuddyWater MITRE ATT&CK G0069 (group name); CISA advisory AA22-055A[1, 2]
Earth Vetala MITRE ATT&CK Associated Groups; AA22-055A[1, 2]
MERCURY MITRE ATT&CK Associated Groups; AA22-055A[1, 2]
Static Kitten MITRE ATT&CK Associated Groups; AA22-055A[1, 2]
Seedworm MITRE ATT&CK Associated Groups; AA22-055A[1, 2]
TEMP.Zagros MITRE ATT&CK Associated Groups; AA22-055A[1, 2]
Mango Sandstorm MITRE ATT&CK Associated Groups[1]
TA450 MITRE ATT&CK Associated Groups[1]
MuddyKrill MITRE ATT&CK Associated Groups[1]

Who says so

Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.

  • MITRE ATT&CK Group page last modified 31 July 2026

    Describes MuddyWater as a cyber espionage group. Says it is assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1]

  • FBI, CISA, CNMF and NCSC-UK 24 February 2022

    Said MuddyWater is a subordinate element within MOIS. Said it has run broad campaigns in support of MOIS objectives since approximately 2018.[2]

  • US National Security Agency 24 February 2022

    Said it agrees with the attribution and the details in advisory AA22-055A.[2]

  • CISA 24 February 2022

    Alert said MuddyWater is conducting cyber espionage and other malicious cyber operations as part of MOIS.[3]

  • UK and US cybersecurity agencies 24 February 2022

    Attribute the Small Sieve malware to MuddyWater with high confidence.[2]

  • CISA, FBI, CNMF, NCSC-UK and NSA 24 February 2022

    Released a malware report on 23 files identified as MuddyWater tools.[4]

  • UK NCSC 24 February 2022

    Published the joint advisory notice. Published a Small Sieve malware analysis report on MuddyWater malware.[6]

  • US Department of the Treasury 9 September 2022

    Said the US identified MuddyWater earlier in 2022. Said it is a subordinate element within MOIS.[5]

  • US Department of the Treasury 9 September 2022

    Said MuddyWater was assessed to be in a campaign against Turkish government entities. Said this was as recently as November 2021.[5]

Where sources differ

Sources differ on when the activity began. MITRE ATT&CK says since at least 2017. Advisory AA22-055A and the US Treasury say broad campaigns since approximately 2018. Sources also differ on names: the advisory lists five other names for the group, while MITRE lists eight.

On ransomware, the advisory and the Treasury say MuddyWater actors are known to deploy it. MITRE does not describe ransomware. It says the group tried to send data to cloud storage using Rclone.

MITRE describes the group as "assessed to be" part of MOIS, a cautious wording. The advisory states the link directly.

Who they target

Sectors

  • Government and private-sector organizationsThe advisory and MITRE list telecommunications among the sectors targeted.[1, 2]
  • Government and private-sector organizationsThe advisory and MITRE list defense among the sectors targeted.[1, 2]
  • Government and private-sector organizationsThe advisory and MITRE list local government among the sectors targeted.[1, 2]
  • Energy organizationsThe advisory and MITRE list oil and natural gas among the sectors targeted.[1, 2]
  • Financial organizationsMITRE lists finance among the sectors targeted. The advisory does not.[1]
  • Email targetsThe advisory table says the group specifically targeted government agency employees. It says it used spearphishing emails.[2]
  • Turkish government entitiesThe Treasury says MuddyWater was assessed to be in a campaign against Turkish government entities. It says this was as recently as November 2021.[5]
  • UAE and Saudi ArabiaMITRE names the UAE and Saudi Arabia in the Middle East.[1]
  • RegionsThe advisory and MITRE list these regions.[1, 2]

Regions

  • United Arab EmiratesMITRE ATT&CK says MuddyWater has targeted government and private organizations in the Middle East, specifically the UAE and Saudi Arabia. The sectors are telecommunications, local government, finance, defense, and oil and natural gas.[1]
  • Saudi ArabiaMITRE says MuddyWater has targeted organizations in the Middle East, specifically the UAE and Saudi Arabia. The sectors are telecommunications, local government, finance, defense, and oil and natural gas.[1]

Operations timeline

Each entry is attributed to the group by the sources cited.

  1. Since at least 2017

    Targeting begins

    MITRE says MuddyWater has targeted government and private organizations since at least 2017.[1]

  2. Approximately 2018

    Broad campaigns for MOIS

    The advisory and the Treasury say the group has run broad campaigns since approximately 2018. They say the campaigns support MOIS objectives.[2, 5]

  3. November 2021

    Turkish government campaign

    The Treasury says MuddyWater was assessed to be involved in a campaign. The campaign targeted Turkish government entities.[5]

  4. Possibly since November 2021

    STARWHALE backdoor

    MITRE says MuddyWater has used STARWHALE. It says this was possibly since at least November 2021.

  5. 12 January 2022

    CNMF note on malware

    MITRE lists a note of this date from the US Cyber Command Cyber National Mission Force. The note is on the Iranian intelligence malware suite.[1]

  6. January 2022

    Small Sieve and Mori

    MITRE says MuddyWater has used the Small Sieve and Mori backdoors. It says this has been so since at least this month.[7]

  7. 24 February 2022

    Joint advisory

    Five US and UK agencies published advisory AA22-055A. They also published a malware report on 23 files.[2, 4]

  8. 9 September 2022

    Treasury sanctions MOIS

    The Treasury designated MOIS and its minister and repeated the MuddyWater identification.[5]

  9. Mid-2025

    Tsundere botnet reported

    MITRE says the botnet was first reported in mid-2025. It says its DinDoor variant has been linked to MuddyWater.[8]

  10. October 2025

    Reused domains

    MITRE says MuddyWater has reused domains dating back to this month.[1]

  11. Late 2025 to early 2026

    Starlink for command and control

    MITRE says the group used satellite internet (Starlink) for command and control.[1]

Government actions

Indictments, sanctions and advisories that name the group or its alleged members.

Government actions about MuddyWater
DateWhoWhat
24 February 2022 CISA, FBI, CNMF, NCSC-UK, NSA Joint advisory AA22-055ADescribed MuddyWater activity, tools and indicators, and listed mitigations.[2, 3]
24 February 2022 CISA, FBI, CNMF, NCSC-UK, NSA Malware analysis reportAnalyzed 23 files identified as MuddyWater tools.[4]
24 February 2022 UK NCSC Malware analysis reportPublished a Small Sieve report with the joint advisory.[6]
9 September 2022 US Department of the Treasury SanctionsDesignated MOIS and its minister under Executive Order 13694. MuddyWater is named as a MOIS element, not as a designated party.[5]

How they get in

Techniques reported for this group, by MITRE ATT&CK tactic.

Resource Development

  • Acquire Infrastructure: Domains T1583.001

    Sets up its own domains, some made to look like real organizations.[1]

Initial Access

  • Phishing: Spearphishing Attachment T1566.001

    Sends targeted attachments, using compromised third-party accounts.[1, 2]

  • Exploit Public-Facing Application T1190

    Exploited the Microsoft Exchange flaw CVE-2020-0688.[1, 2]

Execution

  • User Execution: Malicious File T1204.002

    Tries to get users to enable macros or open malicious PDF and Word files.[1, 2]

  • Command and Scripting Interpreter: PowerShell T1059.001

    Uses PowerShell for execution, with obfuscated scripts.[1, 2]

Persistence

  • Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001

    Adds a Registry Run key to stay on the system.[1, 2]

Credential Access

  • OS Credential Dumping: LSASS Memory T1003.001

    Dumps credentials with Mimikatz and procdump64.exe.[1, 2]

Lateral Movement

  • Exploitation of Remote Services T1210

    Exploited the Netlogon flaw CVE-2020-1472.[1, 2]

Command and Control

  • Remote Access Tools: Remote Desktop Software T1219.002

    Uses remote management tools such as ScreenConnect, AteraAgent and SimpleHelp.[1]

  • Proxy: External Proxy T1090.002

    Hides command servers behind proxy networks and compromised websites.[1, 2]

Exfiltration

  • Exfiltration Over Web Service: Exfiltration to Cloud Storage T1567.002

    Tried to send data to a cloud storage service using Rclone.[1]

Stealth

  • Hijack Execution Flow: DLL T1574.001

    Side-loads DLLs to trick legitimate programs into running malware.[1, 2]

  • Masquerading: Match Legitimate Resource Name or Location T1036.005

    Uses file and Registry names linked to Windows Defender.[1, 2]

Tools and malware

  • POWERSTATS PowerShell backdoor

    First-stage backdoor used by MuddyWater, named in the advisory.[1, 2]

  • PowGoop Loader

    DLL loader and PowerShell downloader that MITRE and the advisory call a main loader.[2]

  • Small Sieve Python backdoor

    Uses the Telegram Bot API. UK and US agencies attribute it to MuddyWater with high confidence.[2, 7]

  • Mori Backdoor

    Uses DNS tunneling for command and control, per the advisory.[2]

  • STARWHALE Script backdoor

    Windows Script File backdoor, also called Canopy in the advisory.[2]

  • MuddyViper Backdoor

    Custom backdoor in C and C++ for command and control and persistence (per MITRE ATT&CK).

  • RustyWater Rust implant

    MITRE says it reflects a shift away from earlier PowerShell tools.

  • DCHSpy Android spyware

    MITRE says it is likely used by MuddyWater and poses as VPN and banking apps.

  • Tsundere Botnet Botnet

    MITRE links the DinDoor variant to MuddyWater. It attributes the botnet itself to a likely Russian-speaking actor.[8]

Also linked in our threat library:

Detection and defense

  1. Patch known exploited flaws first

    Install updates as soon as they are released. Prioritize known exploited vulnerabilities, including Exchange and Netlogon flaws.

    Counters T1190 T1210

  2. Use multifactor authentication

    Require it for webmail, VPNs and accounts that reach critical systems, as the advisory advises.

    Counters T1566.001 T1003.001

  3. Train users and add email warnings

    Run awareness training and phishing simulations. Consider an outside-mail banner and disable hyperlinks in received email.

    Counters T1566.001 T1204.002

  4. Control which programs can run

    Deploy application control software to limit applications and executable code users can run.

    Counters T1204.002 T1059.001 T1574.001

  5. Limit administrator rights

    Restrict admin privileges so an infected account cannot move across the network.

    Counters T1003.001 T1210

  6. Keep antivirus current and use reputation services

    Update signatures promptly. Check email addresses, files, URLs and IP addresses against reputation services.

    Counters T1036.005 T1566.001

  7. Investigate when several of the group's tools appear

    The advisory says finding multiple tools on one network should lead to further investigation. Review remote management software not approved by IT.

    Counters T1219.002 T1105

  8. Search for indicators of compromise

    Check networks against the indicators in the advisory and malware report.

    Counters T1071.001 T1090.002

What Brandefense can do

Questions

Who is MuddyWater?

MITRE ATT&CK describes it as a cyber espionage group assessed to be part of Iran's MOIS. The FBI, CISA, CNMF, NCSC-UK and NSA said so in advisory AA22-055A on 24 February 2022.

Are they still active?

MITRE says the group used satellite internet for command and control in late 2025 and early 2026. It says this on a page last modified 31 July 2026.

Who do they target?

The advisory lists sectors in Asia, Africa, Europe and North America. They are telecommunications, defense, local government and oil and natural gas. MITRE adds finance and the UAE and Saudi Arabia.

How do they get in?

Spearphishing emails, often from compromised accounts. It also uses known flaws such as Exchange CVE-2020-0688 and Netlogon CVE-2020-1472.

Do they use ransomware?

The advisory and the US Treasury both say MuddyWater actors are known to deploy ransomware.

What should we do first?

Patch known exploited flaws. Turn on multifactor authentication for webmail and VPN. Train staff on phishing.

In our research

  1. OilRig: Iran’s Persistent Espionage Arm in Cyberspace December 2025
  2. BugSleep Backdoor Technical Analysis December 2025
  3. APT42: Iran’s Shadow Operative in Global Cyberspace November 2025
  4. MuddyWater: Iran-Linked Espionage Group Expanding Global Reach November 2025
  5. APT33 (Elfin / Refined Kitten): Iran’s Longstanding Cyber-Espionage Arm November 2025
  6. APT Groups in the MENA Region: Key Threat Actors in Cyber Espionage October 2025
  7. EASM Best Practices for the Energy Sector October 2025
  8. Innovative Solutions to EASM Challenges for 2026 October 2025

Sources

  1. MuddyWater, Group G0069 MITRE ATT&CK Supports: MOIS assessment, names, targets, techniques, software, late 2025 and early 2026 activity
  2. Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks (AA22-055A) CISA with FBI, CNMF, NCSC-UK and NSA Supports: MOIS attribution, targets, entry methods, tools, ransomware, mitigations
  3. Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations CISA Supports: CISA alert of 24 February 2022 linking MuddyWater to MOIS
  4. MAR-10369127-1.v1 MuddyWater (AR22-055A) CISA with FBI, CNMF, NCSC-UK and NSA Supports: Malware analysis report on 23 files identified as MuddyWater tools
  5. Treasury Sanctions Iranian Ministry of Intelligence and Minister for Malign Cyber Activities US Department of the Treasury Supports: 9 September 2022 sanctions on MOIS, MuddyWater identified as a MOIS element, Turkey campaign
  6. Joint advisory on MuddyWater actor UK National Cyber Security Centre Supports: NCSC-UK part in the advisory and its Small Sieve malware report
  7. Small Sieve, Software S1035 MITRE ATT&CK Supports: Small Sieve backdoor, use since at least January 2022
  8. Tsundere Botnet, Software S9034 MITRE ATT&CK Supports: DinDoor variant linked to MuddyWater

Other groups

All groups

Andariel

Attributed by the US, UK and South Korean governments to North Korea's Reconnaissance General Bureau, Andariel is described in a July 2024 joint advisory as stealing defense, aerospace and nuclear secrets and funding that work with ransomware against US healthcare. MITRE ATT&CK describes it as a sub-set of Lazarus Group; the advisory does not use that term.

Attributed by the US, UK and South Korean governments, and MITRE ATT&CK

  • KPAttributed to North Korea
Active since 2009 Full profile

APT-C-60

APT-C-60 is the name JPCERT/CC uses for a threat group it says likely carried out spear-phishing attacks on organizations in Japan from August 2024, using fake job-applicant emails and a backdoor called SpyGlace. No government or MITRE source opened for this page says who is behind it.

Short profile

APT1

Also known as Comment Crew · Comment Panda · Comment Group

Attributed by MITRE ATT&CK to PLA Unit 61398 in China, APT1 is the subject of a US indictment of 19 May 2014 charging five Unit 61398 officers with hacking six US organizations. The Department of Justice alleges the aim was commercial gain for China's state-owned firms.

Attributed by the US Department of Justice (indictment of 19 May 2014) and MITRE ATT&CK

  • CNAttributed to China
Active since 2006 Full profile

Keep exploring

Knowledge Hub

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more