MITRE ATT&CK - MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). [1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13]

MuddyWater uses various techniques to bypass UAC. [6] [11]

MuddyWater has used cmd.exe net user /domain to enumerate domain users. [14]

MuddyWater has established domains, some of which appeared to spoof legitimate domains for use in operations. [11]

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools. [15] [14] [18] [12]

MuddyWater has used HTTP for C2 communications. [7] [14]

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded. [5]

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence. [16] [20] [21] [8] [14] [10]

MuddyWater has used PowerShell for execution. [16] [22] [20] [5] [6] [21] [8] [14] [9] [10] [11]

MuddyWater has used a custom tool for creating reverse shells. [5]

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros. [16] [22] [20] [5] [6] [7] [8] [14] [10]

MuddyWater has developed tools in Python including Out1 . [14]

MuddyWater has used JavaScript files to execute its POWERSTATS payload. [6] [16] [9]

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email. [4] [5] [14]

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers. [5] [14]

MuddyWater has used tools to encode C2 communications including Base64 encoding. [7] [14]

MuddyWater has stored a decoy PDF file within a victim's %temp% folder. [10]

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript. [16] [22] [6] [10]

MuddyWater can disable the system's local proxy settings. [14]

MuddyWater has used AES to encrypt C2 responses. [10]

MuddyWater has used C2 infrastructure to receive exfiltrated data. [8]

MuddyWater has attempted to exfiltrate data to Wasabi, a cloud storage service, using Rclone . [23]

MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688). [9]

MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution. [7]

MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472). [9]

MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET." [20]

MuddyWater has mapped target networks; access to this information and more is then shared/sold to other Iran threat actors. [24]

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware. [9]

MuddyWater has used malware that can upload additional files to the victim’s machine. [20] [6] [8] [14] MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data. [11]

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook. [20] [7] [9]

MuddyWater has used malware that can execute PowerShell scripts via DDE. [20]

MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails. [2]

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender. [16] [21] [15]

MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back. [21]

MuddyWater has used ports 8043 and 8848 for botnet C2 communication. [24]

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg. [6]

MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code. [6]

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. [4] [25] The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands. [4] [16] [20] [21] [7] [14] [10]

MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals. [3]

MuddyWater has used legitimate tools ConnectWise , RemoteUtilities , and SimpleHelp to gain access to the target environment. [15] [26] [12] [11]

MuddyWater has used a Word Template, Normal.dotm, for persistence. [8]

MuddyWater has performed credential dumping with Mimikatz and procdump64.exe. [4] [5] [14]

MuddyWater has performed credential dumping with LaZagne . [4] [5]

MuddyWater has performed credential dumping with LaZagne . [4] [5]

MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com. [11]

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. [4] [16] [20] [7] [15] [14] [9] [18] [12] [23] MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the stage. [27]

MuddyWater has sent targeted spearphishing e-mails with malicious links. [15] [14] [18]

MuddyWater has used malware to obtain a list of running processes on the system. [20] [7]

MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France. [2]

MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. [5] MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2). [8] [14] MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT), to communicate with a hardcoded C2 server, and to exfiltrate data. [12]

MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration. [14] [15] [18] [26] [2] [11] [24]

MuddyWater has used scheduled tasks to establish persistence. [8]

MuddyWater has used malware that can capture screenshots of the victim’s machine. [20]

MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft. [11] MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell. [27]

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine. [14]

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers. [20]

MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload. [16]

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution. [16] [20]

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll. [20]

MuddyWater has used malware that can collect the victim’s OS version and machine name. [20] [21] [8] [14] [10]

MuddyWater has used malware to collect the victim’s IP address and domain name. [20]

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine. [14]

MuddyWater has used malware that can collect the victim’s username. [20] [14]

MuddyWater has run a tool that steals passwords saved in victim email. [5]

MuddyWater has distributed URLs in phishing e-mails that link to lure documents. [15] [14] [18]

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. [4] [16] [20] [21] [7] [8] [15] [14] [9] [10] [18] Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed. [27]

MuddyWater has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code. [11]

MuddyWater has used web services including OneHub to distribute remote access tools. [15]

MuddyWater has used malware that leveraged WMI for execution and querying host information. [20] [6] [21] [9]