Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by MITRE ATT&CK, the FBI, CISA, NCSC-UK and the US Treasury to Iran's Ministry of Intelligence and Security (MOIS), this group is described as running cyber espionage against telecommunications, defense, local government and oil and gas organizations.
In short
Attributed by MITRE ATT&CK, the FBI, CISA, NCSC-UK and the US Treasury to Iran's Ministry of Intelligence and Security (MOIS), this group is described as running cyber espionage against telecommunications, defense, local government and oil and gas organizations. The 2022 joint advisory says it gets in by spearphishing and known software flaws, and shares access with other actors.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| MuddyWater | MITRE ATT&CK G0069 (group name); CISA advisory AA22-055A[1, 2] |
| Earth Vetala | MITRE ATT&CK Associated Groups; AA22-055A[1, 2] |
| MERCURY | MITRE ATT&CK Associated Groups; AA22-055A[1, 2] |
| Static Kitten | MITRE ATT&CK Associated Groups; AA22-055A[1, 2] |
| Seedworm | MITRE ATT&CK Associated Groups; AA22-055A[1, 2] |
| TEMP.Zagros | MITRE ATT&CK Associated Groups; AA22-055A[1, 2] |
| Mango Sandstorm | MITRE ATT&CK Associated Groups[1] |
| TA450 | MITRE ATT&CK Associated Groups[1] |
| MuddyKrill | MITRE ATT&CK Associated Groups[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Group page last modified 31 July 2026
Describes MuddyWater as a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1]
FBI, CISA, CNMF and NCSC-UK 24 February 2022
Said MuddyWater is a subordinate element within MOIS, with broad campaigns in support of MOIS objectives since approximately 2018.[2]
US National Security Agency 24 February 2022
Said it agrees with the attribution and the details in advisory AA22-055A.[2]
CISA 24 February 2022
Alert said MuddyWater is conducting cyber espionage and other malicious cyber operations as part of MOIS.[3]
UK and US cybersecurity agencies 24 February 2022
Attribute the Small Sieve malware to MuddyWater with high confidence.[2]
CISA, FBI, CNMF, NCSC-UK and NSA 24 February 2022
Released a malware report on 23 files identified as MuddyWater tools.[4, 5]
UK NCSC 24 February 2022
Published the joint advisory notice and a Small Sieve malware analysis report on MuddyWater malware.[7]
US Department of the Treasury 9 September 2022
Said the US identified MuddyWater earlier in 2022 as a subordinate element within MOIS.[6]
US Department of the Treasury 9 September 2022
Said that as recently as November 2021 MuddyWater was assessed to be in a campaign against Turkish government entities.[6]
Sources differ on when the activity began. MITRE ATT&CK says since at least 2017. Advisory AA22-055A and the US Treasury say broad campaigns since approximately 2018. Sources also differ on names: the advisory lists five other names for the group, while MITRE lists eight. On ransomware, the advisory and the Treasury say MuddyWater actors are known to deploy it, while MITRE does not describe ransomware but says the group tried to send data to cloud storage using Rclone. MITRE describes the group as "assessed to be" part of MOIS, a cautious wording, while the advisory states the link directly.
Each entry is attributed to the group by the sources cited.
MITRE says MuddyWater has targeted government and private organizations since at least 2017.[1]
The Treasury says MuddyWater was assessed to be involved in a campaign targeting Turkish government entities.[6]
MITRE says STARWHALE has been used by MuddyWater, possibly since at least November 2021.[12]
MITRE lists a US Cyber Command Cyber National Mission Force note of this date on the Iranian intelligence malware suite.[1]
The Treasury designated MOIS and its minister and repeated the MuddyWater identification.[6]
MITRE says the botnet was first reported in mid-2025 and that its DinDoor variant has been linked to MuddyWater.[16]
MITRE says MuddyWater has reused domains dating back to this month.[1]
MITRE says the group used satellite internet (Starlink) for command and control.[1]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 24 February 2022 | CISA, FBI, CNMF, NCSC-UK, NSA | Joint advisory AA22-055ADescribed MuddyWater activity, tools and indicators, and listed mitigations.[2, 3] |
| 24 February 2022 | CISA, FBI, CNMF, NCSC-UK, NSA | Malware analysis reportAnalyzed 23 files identified as MuddyWater tools.[4, 5] |
| 24 February 2022 | UK NCSC | Malware analysis reportPublished a Small Sieve report with the joint advisory.[7] |
| 9 September 2022 | US Department of the Treasury | SanctionsDesignated MOIS and its minister under Executive Order 13694. MuddyWater is named as a MOIS element, not as a designated party.[6] |
Techniques reported for this group, by MITRE ATT&CK tactic.
POWERSTATS PowerShell backdoor
First-stage backdoor used by MuddyWater, named in the advisory.[1, 2, 8]
PowGoop Loader
DLL loader and PowerShell downloader that MITRE and the advisory call a main loader.[2, 9]
Small Sieve Python backdoor
Uses the Telegram Bot API; UK and US agencies attribute it to MuddyWater with high confidence.[2, 10]
Mori Backdoor
Uses DNS tunneling for command and control, per the advisory.[2, 11]
STARWHALE Script backdoor
Windows Script File backdoor, also called Canopy in the advisory.[2, 12]
MuddyViper Backdoor
Custom backdoor in C and C++ for command and control and persistence.[13]
RustyWater Rust implant
MITRE says it reflects a shift away from earlier PowerShell tools.[14]
DCHSpy Android spyware
MITRE says it is likely used by MuddyWater and poses as VPN and banking apps.[15]
Tsundere Botnet Botnet
MITRE links the DinDoor variant to MuddyWater; it attributes the botnet itself to a likely Russian-speaking actor.[16]
Also linked in our threat library:
Find look-alike domains and fake sign-in pages aimed at your staff, since the group is described as setting up spoofed domains and phishing.
Watch for leaked or sold company credentials, since the group dumps credentials after getting in.
See which mail and domain servers face the internet, the exposed systems the advisory says were exploited.
Follow what governments and MITRE report about this group and compare its techniques with your own controls.
MITRE ATT&CK describes it as a cyber espionage group assessed to be part of Iran's MOIS. The FBI, CISA, CNMF, NCSC-UK and NSA said so in advisory AA22-055A on 24 February 2022.
MITRE, on a page last modified 31 July 2026, says the group used satellite internet for command and control in late 2025 and early 2026.
The advisory lists telecommunications, defense, local government and oil and natural gas in Asia, Africa, Europe and North America. MITRE adds finance and the UAE and Saudi Arabia.
Spearphishing emails, often from compromised accounts, and known flaws such as Exchange CVE-2020-0688 and Netlogon CVE-2020-1472.
The advisory and the US Treasury both say MuddyWater actors are known to deploy ransomware.
Patch known exploited flaws, turn on multifactor authentication for webmail and VPN, and train staff on phishing.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.