ClassicBrechasMapaActoresTTP MatrixAnaliticaAlertasCyberNewsArsenalExploitsKillChainOrigenSSLBLRansomLookRansomwhere
MuddyWater
1 incidentes
1 paises
0 sectores
apt IR Ultimo: 2026-05-25
Aliases: ATK51, Boggy Serpens, COBALT ULSTER, Earth Vetala, G0069, MERCURY, Mango Sandstorm, Seedworm, Static Kitten, TA450, TEMP.Zagros, TEMP
MuddyWater, also known by aliases such as Earth Vetala, MERCURY, Static Kitten, Seedworm, and G0069, is a cyber espionage group that emerged in early 2017, with initial activities documented from February of that year. The group is assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS), and its primary motivation is strategic intelligence collection rather than financial gain. MuddyWater has evolved from initially relying on broad mass phishing campaigns and extensive use of Remote Monitoring and Management (RMM) tools to more targeted approaches incorporating custom backdoors like Phoenix and StealthCache, alongside its continued use of malicious documents. A distinguishing characteristic of MuddyWater is its heavy reliance on "living-off-the-land" techniques, leveraging legitimate system tools and obfuscated PowerShell scripts to maintain a low profile and evade detection. The group has shown an increasing sophistication in its operations, inc