Glossary term
Spear phishing
Spear phishing is phishing aimed at a chosen person or group instead of a large crowd.
Read more
Significant cyber incident
MuddyWater campaign against Turkish government entities
In short
The US Treasury said in September 2022 that MuddyWater, a subordinate element of Iran's Ministry of Intelligence and Security, was assessed to have been involved, as recently as November 2021, in a campaign targeting Turkish government entities with malware-laden documents likely sent by spear-phishing email. The release names no Turkish body, gives no start date and reports no losses.
What happened
In a press release of 9 September 2022 about sanctions on Iran’s Ministry of Intelligence and Security, the US Treasury said that MuddyWater was assessed to be involved in a cyber campaign targeting Turkish government entities as recently as November 2021. It said the campaign delivered documents containing malware, likely through spear-phishing emails, to gain access to victims’ systems.
The same release describes MuddyWater as a subordinate element within the Ministry of Intelligence and Security that has run broad cyber campaigns since about 2018. It names no Turkish body, gives no start date for the campaign and reports no losses.
Earlier, on 24 February 2022, the FBI, CISA, US Cyber Command, the NSA and the UK National Cyber Security Centre published advisory AA22-055A on how the group works. The advisory lists telecommunications, defense, local government and oil and gas targets in Asia, Africa, Europe and North America. It does not name Turkey.
How the attack worked
What the Treasury describes
The campaign delivered documents containing malware. The Treasury says they were likely sent by spear-phishing email, and that the aim was to gain access to victims' systems.
How the group usually works
The joint advisory describes the group in general, not this campaign. It says MuddyWater mainly uses spear-phishing with malicious attachments, such as Excel files with macros and PDFs, and also exploits publicly known flaws, including CVE-2020-1472 (Netlogon) and CVE-2020-0688 (Microsoft Exchange). It lists tools such as PowGoop, Small Sieve, Canopy, Mori and POWERSTATS. These tools are not tied to the Turkish campaign in any source opened.
ATT&CK techniques
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the US Treasury: MuddyWater was assessed to be involved in the campaign and is described as a subordinate element within Iran's Ministry of Intelligence and Security. The wording is careful: the Treasury says assessed and likely. The release gives November 2021 as the latest date, not a start date. The February 2022 advisory lists regions for the group's work but does not name Turkey, so the two US documents do not conflict, they simply cover different ground.
Impact
The Treasury release does not name the Turkish bodies affected, and it reports no losses, stolen data or counts. It states only the aim: access to victims' systems. Nothing more can be said about the damage from the sources opened.
Government and regulator response
The Treasury announced sanctions on the Ministry of Intelligence and Security and its minister on 9 September 2022, and gave the Turkish campaign as one example of the group’s activity.
No statement from a Turkish authority about this campaign appears in the sources opened. The mitigations below come from the joint advisory on the group, not from a response to this campaign.
Lessons
-
Documents are still the door
The Treasury says the campaign used malware inside documents, likely sent by email. The advisory on the group says the same of its general method.
-
Public detail about this case is small
One sentence in one Treasury release describes the Turkish campaign. For planning, use the advisory on the group, which describes methods, rather than guess at this case.
-
Known flaws were in the group's toolkit
The advisory names two public flaws the group exploits. Unpatched servers add a second way in beyond email.
What to check in your own organization
-
Patch known exploited flaws first
The advisory asks for urgent patching and names CVE-2020-1472 and CVE-2020-0688.
-
Use application control
Listed in the advisory's mitigations.
-
Turn on multi-factor authentication
Listed in the advisory's mitigations.
-
Train staff to spot phishing
The advisory lists user training on recognising phishing.
-
Limit administrator rights and keep antivirus current
Both are in the advisory's list.
Where it happened
Questions
What did the US Treasury say about MuddyWater and Turkey?
In a press release of 9 September 2022, the Treasury said MuddyWater was assessed to be involved, as recently as November 2021, in a campaign targeting Turkish government entities. It said malware-laden documents were likely sent by spear-phishing email.
Who is MuddyWater?
The same Treasury release describes MuddyWater as a subordinate element within Iran's Ministry of Intelligence and Security that has run broad cyber campaigns since about 2018.
How does MuddyWater usually attack?
A joint advisory from February 2022 says the group mainly uses spear-phishing with malicious attachments such as Excel files with macros and PDFs, and also exploits publicly known flaws. The advisory describes the group in general, not this campaign.
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.