IranAttributedMOISEspionageActive 2017 – 2026MuddyWater
Also known asMuddy Water · Static Kitten · MERCURY · Seedworm · TA450 · Yellow Nix · TEMP.Zagros · Cobalt Ulster · Mango Sandstorm · Boggy Serpens · ATK51 · T-APT-14 · ITG17 · Earth Vetala · MuddyKrill
Summary
MOIS-linked Iranian APT (Microsoft: Mango Sandstorm, formerly MERCURY; CrowdStrike: Static Kitten; Proofpoint: TA450; Symantec: Seedworm; ESET: it "may be acting as an initial access broker for other Iran-aligned groups"). Operation Olalampo (Group-IB, first observed 26 Jan 2026, active into mid-Feb 2026) deployed four previously unseen malware families against MENA targets: GhostFetch, CHAR (Telegram-bot C2), HTTP_VIP, and GhostBackDoor. From February 2026 Symantec observed the group on networks of a US bank, airport and software company with the Deno-based Dindoor backdoor. The group also hides behind criminal brands: the October 2025 Qilin-branded attack on Israel's Shamir Medical Center (likely Iranian operators per Check Point; linked to MuddyWater per Rapid7) and an early-2026 Chaos ransomware false flag (Rapid7, moderate confidence).
Attribution
AttributedGovernment attribution: MOIS
Ministry of Intelligence and Security
Named by a government: indictment, sanctions designation, joint advisory or official statement.
Sources
- CISA, FBI, NSA, NCSC and USCYBERCOM (AA22-055A) (Government, 2022-02-24)
A subordinate element within the Ministry of Intelligence and Security - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Subordinate element within the MOIS
Campaigns 14
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Compromised Israeli IT vendor used to spearphish Israel and the US — ScreenConnect payload | 2026-08 | Israel, USA | Technology | ESET Research (2026-10-28) — MuddyWater "came back online" after a wartime lull |
| Seedworm — US bank, airport, software company and non-profits (Dindoor) | 2026-02 – ongoing | USA, Canada, Israel | Financial Services, Aviation, Software, NGO | Symantec / Carbon Black (2026-03-05) |
| Operation Olalampo | 2026-01 – 2026-02 | MENA | Energy, Marine Services, Telecommunications | Group-IB (2026-02-20) |
| Seedworm Q1 2026 global espionage — Node.js loader, signed-binary DLL side-loading, ChromElevator | 2026-01 – 2026-03 | South Korea, Middle East, Southeast Asia, Latin America | Electronics Manufacturing, Industrial Manufacturing, Aviation, Government, Education, Financial Services, Professional Services | Symantec / Carbon Black (2026-05-26) |
| Chaos ransomware false flag via Microsoft Teams vishingASSESSED | 2026 | USA | Multiple | Rapid7 (2026-05-06) |
| Egyptian financial institution intrusion | 2025-11 | Egypt | Financial Services | Trellix (2026-03-05) |
| International organisation headquartered in Saudi Arabia (pre-war) | 2025-10 – 2026-02 | Saudi Arabia | International Organisations | ESET APT Activity Report Q4 2025–Q1 2026 (2026-05-28) |
| Qilin-branded attack on Shamir Medical CenterASSESSED | 2025-10 | Israel | Healthcare | Check Point Research (2026-03-10); Rapid7 (2026-05-06) |
| Phoenix v4 phishing via compromised mailbox — 100+ government entities | 2025-08 | MENA, Global | Government, International Organisations | Group-IB (2025-10-22) |
| US transportation & manufacturing attacks (Israel–Iran war period) | 2025-05 – 2025-06 | USA | Transportation, Manufacturing | Nozomi Networks Labs (2025-07-08) |
| Internal Spearphishing via Compromised Mailbox | 2025-04 – 2025-09 | Middle East, EU | Government, Financial | ESET APT Activity Report Q2–Q3 2025 (2025-11-06) |
| RMM-software spearphishing waves | 2024-10 – 2025-03 | Israel, Cambodia, Kenya | Engineering, Government, Manufacturing | ESET APT Activity Report Q4 2024–Q1 2025 (2025-05-19) |
| MuddyViper / Fooder — Israel & Egypt critical infrastructure | 2024-09 – 2025-03 | Israel, Egypt | Engineering, Local Government, Manufacturing, Technology, Transportation, Utilities, Academia | ESET (2025-12-02) |
| Destructive attack on a hybrid on-premises and Azure environment, handed to DEV-1084 (DarkBit persona) | 2022-07 – 2023 | Undisclosed | Undisclosed | Microsoft Threat Intelligence (2023-04-07) — MERCURY (Mango Sandstorm) gained access, including Log4j 2 exploitation in July 2022, then handed off to DEV-1084 (Storm-1084), which posed as the DarkBit ransomware persona; end is the publication year; victim not named |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 16
| Reconnaissance1 | T1590.004Network Topology |
|---|---|
| Initial Access2 | T1566.001Spearphishing AttachmentT1566Phishing |
| Execution4 | T1059.001PowerShellT1047Windows Management InstrumentationT1204.004Malicious Copy and PasteT1059.007JavaScript |
| Stealth1 | T1574.001DLL |
| Credential Access1 | T1003.002Security Account Manager |
| Lateral Movement1 | T1534Internal Spearphishing |
| Exfiltration2 | T1567.002Exfiltration to Cloud StorageT1567Exfiltration Over Web Service |
| Command and Control4 | T1219Remote Access ToolsT1090ProxyT1219.002Remote Desktop SoftwareT1102.002Bidirectional Communication |
Malware and tools 20
| Name | Description | Platform |
|---|---|---|
| PhonyC2 | PowerShell C2 Framework | Windows |
| BugSleep | Custom Backdoor | Windows |
| DarkBit | Ransomware under the DarkBit persona — deployed by DEV-1084 after MERCURY access (Microsoft) | Windows |
| PowGoop | Loader | Windows |
| GhostFetch | Custom Loader | Windows |
| CHAR | Custom Backdoor | Windows |
| HTTP_VIP | C2 Beacon | Windows |
| GhostBackDoor | Backdoor | Windows |
| MuddyViper | C/C++ backdoor | Windows |
| Fooder | Reflective loader (Snake-game masquerade) | Windows |
| LP-Notes | Credential stealer | Windows |
| CE-Notes | Browser-data stealer | Windows |
| Blub | Browser-data stealer | Windows |
| Phoenix | Backdoor (v4 in 2025) | Windows |
| FakeUpdate | AES injector-style loader | Windows |
| UDPGangster | UDP-based backdoor | Windows |
| RustyWater | Rust implant | Windows |
| StealthCache | Custom implant | Windows |
| Dindoor | Deno-runtime backdoor (Tsundere botnet variant) | Windows |
| ChromElevator | Open-source Chromium credential/cookie stealer (App-Bound Encryption bypass), sideloaded | Windows |
Exploited vulnerabilities 3
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2020-1472 | 10 | Microsoft Netlogon — Zerologon privilege escalation (KEV 2021-11-03) |
| CVE-2020-0688 | 8.8 | Exchange Validation Key (KEV 2021-11-03) |
| CVE-2017-0199 | 7.8 | Microsoft Office/WordPad — RTF/HTA remote code execution (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Legitimate RMM tools for access — ConnectWise, RemoteUtilities, SimpleHelp, AnyDesk (MITRE ATT&CK, 2026; Group-IB, 2026)
- Compromised mailbox used to send phishing to 100+ government entities (Group-IB, 2025)
Reporting and advisories 16
- CISA
AA22-055A — Iranian Government-Sponsored Actors - ESET APT Activity Report Q4 2024–Q1 2025
RMM-software spearphishing waves - ESET APT Activity Report Q2–Q3 2025
Internal Spearphishing via Compromised Mailbox - Group-IB
Operation Olalampo - Check Point Research
Qilin-branded attack on Shamir Medical Center - ESET
MuddyViper / Fooder — Israel & Egypt critical infrastructure - Nozomi Networks Labs
US transportation & manufacturing attacks (Israel–Iran war period) - Group-IB
Phoenix v4 phishing via compromised mailbox — 100+ government entities - Trellix
Egyptian financial institution intrusion - Symantec / Carbon Black
Seedworm — US bank, airport, software company and non-profits (Dindoor) - Rapid7
Chaos ransomware false flag via Microsoft Teams vishing - Symantec / Carbon Black
Seedworm Q1 2026 global espionage — Node.js loader, signed-binary DLL side-loading, ChromElevator - MITRE ATT&CK
MuddyWater (G0069) group profile - Microsoft Threat Intelligence
MERCURY and DEV-1084: destructive attack on hybrid environment (Apr 2023) - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026) - Deep Instinct
PhonyC2: Revealing a New Malicious Command & Control Framework by MuddyWater (Jun 2023)