AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
MuddyWater
Aliases: Earth Vetala, MERCURY, Mango Sandstorm, MuddyKrill, MuddyWater, Seedworm, Static Kitten, TA450, TEMP.Zagros
[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, [MuddyWater](https://attack.mitre.org/groups/G0069) has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. [MuddyWater](https://attack.mitre.org/groups/G0069) has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, [MuddyWater](https://attack.mitre.org/groups/G0069) used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. (Citation: FalconFeeds_Iran_Mar2026)(Citation: Huntio_IranInfra_Mar2026)(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)(Citation: ESET_MuddyWater_Dec2025)(Citation: SymantecCarbonBlack_Seedworm_Mar2026)
Open interactive actor investigation
ATT&CK techniques
T1003.001T1003.004T1003.005T1016T1027.003T1027.004T1027.010T1033T1036.005T1041T1047T1049T1053.005T1057T1059.001T1059.003T1059.005T1059.006T1059.007T1071.001T1074.001T1082T1083T1087.002T1090T1090.002T1102.002T1104T1105T1113T1132.001T1137.001T1140T1190T1203T1204.001T1204.002T1204.004T1210T1218.003T1218.005T1218.011T1219.002T1518T1518.001T1534T1547.001T1548.002T1552.001T1555T1555.003T1559.001T1559.002T1560.001T1566T1566.001T1566.002T1567.002T1571T1573.001T1574.001T1583.001T1583.006T1588.001T1588.002T1590.004T1684.001T1685
Correlated CTI and IR reports
MuddyWater G0069
MITRE ATT&CK · direct source mappingStryker Handala MOIS and MuddyWater: Full Kill Chain and Unified Detection Pack v3
ThreatHunter.ai · direct source mappingMuddyWater: Snakes by the riverbank
ESET Research · actor referenceNew BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
Check Point Research · actor referenceOverview of Recent Phishing
Israel National Cyber Directorate · actor referenceUnmasking: Technological Advancement and Evolution of MuddyWater in 2024
Israel National Cyber Directorate · actor referenceCTI Research: MuddyWater/Seedworm Mango Sandstorm
Andrey Pautov · actor reference1. Executive Summary
Israel Threat Actors CTI · explicit report mentionActor Deep Research Prompts
Israel Threat Actors CTI · explicit report mentionAndrey Pautov Medium Articles
Israel Threat Actors CTI · explicit report mentionBlue-Team IOC Tables — Consolidated
1200km CTI repository · explicit report mentionCTI
1200km CTI repository · explicit report mentionCTI Research Template
1200km CTI repository · explicit report mentionCTI Research: MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mentionCTI Research: MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mentionCTI Research: MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mentionCyber Threat Intelligence Dossier: Iranian and Hamas-Aligned Operations Targeting Israeli and Allied Ecosystems (2023-2026)
Israel Threat Actors CTI · explicit report mentionDefensive CTI Research on Threats to Israeli Government and Public-Sector Environments
Israel Threat Actors CTI · explicit report mentionDefensive Cyber Threat Intelligence Report: Israeli Critical Infrastructure and Geopolitical Escalation (2024-2026)
Israel Threat Actors CTI · explicit report mentionIOC Tables — MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mentionIsrael Government Threat Actors CTI: Evidentiary Foundation Intake
Israel Threat Actors CTI · explicit report mentionMuddyWater / Seedworm
CTI Analyst Field Manual · explicit report mentionRelease Notes
Israel Threat Actors CTI · explicit report mentionReport Index
Israel Threat Actors CTI · explicit report mentionResearch Intake Upgrade Summary
Israel Threat Actors CTI · explicit report mentionWorked Cases
Israel Threat Actors CTI · explicit report mentionCTI Analyst Field Manual Complete Reference
1200km Medium · authored report mentionCTI Led Defensive Strategy for a Cellular Provider Case Study
1200km Medium · authored report mentionCTI Research MuddyWater Seedworm Mango Sandstorm
1200km Medium · authored report mentionBoggy Serpens Threat Assessment
Unit 42 · actor contextIranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks
CISA · actor contextIranian Government-Sponsored Threat Actor MuddyWater
Israel National Cyber Directorate · actor contextIranian MOIS Actors and the Cyber Crime Connection
Check Point Research · actor contextMERCURY and DEV-1084: Destructive attack on hybrid environment
Microsoft Security · actor contextAPT and financial attacks on industrial organizations in Q4 2025
Kaspersky ICS CERT · actor contextMuddyWater APT 2025
Brandefense · actor context
MITRE ATT&CK · direct source mappingStryker Handala MOIS and MuddyWater: Full Kill Chain and Unified Detection Pack v3
ThreatHunter.ai · direct source mappingMuddyWater: Snakes by the riverbank
ESET Research · actor referenceNew BugSleep Backdoor Deployed in Recent MuddyWater Campaigns
Check Point Research · actor referenceOverview of Recent Phishing
Israel National Cyber Directorate · actor referenceUnmasking: Technological Advancement and Evolution of MuddyWater in 2024
Israel National Cyber Directorate · actor referenceCTI Research: MuddyWater/Seedworm Mango Sandstorm
Andrey Pautov · actor reference1. Executive Summary
Israel Threat Actors CTI · explicit report mentionActor Deep Research Prompts
Israel Threat Actors CTI · explicit report mentionAndrey Pautov Medium Articles
Israel Threat Actors CTI · explicit report mentionBlue-Team IOC Tables — Consolidated
1200km CTI repository · explicit report mentionCTI
1200km CTI repository · explicit report mentionCTI Research Template
1200km CTI repository · explicit report mentionCTI Research: MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mentionCTI Research: MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mentionCTI Research: MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mentionCyber Threat Intelligence Dossier: Iranian and Hamas-Aligned Operations Targeting Israeli and Allied Ecosystems (2023-2026)
Israel Threat Actors CTI · explicit report mentionDefensive CTI Research on Threats to Israeli Government and Public-Sector Environments
Israel Threat Actors CTI · explicit report mentionDefensive Cyber Threat Intelligence Report: Israeli Critical Infrastructure and Geopolitical Escalation (2024-2026)
Israel Threat Actors CTI · explicit report mentionIOC Tables — MuddyWater / Seedworm (Mango Sandstorm)
1200km CTI repository · explicit report mentionIsrael Government Threat Actors CTI: Evidentiary Foundation Intake
Israel Threat Actors CTI · explicit report mentionMuddyWater / Seedworm
CTI Analyst Field Manual · explicit report mentionRelease Notes
Israel Threat Actors CTI · explicit report mentionReport Index
Israel Threat Actors CTI · explicit report mentionResearch Intake Upgrade Summary
Israel Threat Actors CTI · explicit report mentionWorked Cases
Israel Threat Actors CTI · explicit report mentionCTI Analyst Field Manual Complete Reference
1200km Medium · authored report mentionCTI Led Defensive Strategy for a Cellular Provider Case Study
1200km Medium · authored report mentionCTI Research MuddyWater Seedworm Mango Sandstorm
1200km Medium · authored report mentionBoggy Serpens Threat Assessment
Unit 42 · actor contextIranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks
CISA · actor contextIranian Government-Sponsored Threat Actor MuddyWater
Israel National Cyber Directorate · actor contextIranian MOIS Actors and the Cyber Crime Connection
Check Point Research · actor contextMERCURY and DEV-1084: Destructive attack on hybrid environment
Microsoft Security · actor contextAPT and financial attacks on industrial organizations in Q4 2025
Kaspersky ICS CERT · actor contextMuddyWater APT 2025
Brandefense · actor context
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PowerSploit tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Koadic tool reference — Explicit actor uses software relationship in pinned ATT&CK
- LaZagne tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Empire tool reference — Explicit actor uses software relationship in pinned ATT&CK
- CrackMapExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ConnectWise tool reference — Explicit actor uses software relationship in pinned ATT&CK
- RemoteUtilities tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Out1 tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Rclone tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.004 LSA Secrets simulation — Exact active technique ID
- T1003.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.005 Cached Domain Credentials simulation — Exact active technique ID
- T1003.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.003 Steganography simulation — Exact active technique ID
- T1027.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.004 Compile After Delivery simulation — Exact active technique ID
- T1027.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.010 Command Obfuscation simulation — Exact active technique ID
- T1027.010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1033 System Owner/User Discovery simulation — Exact active technique ID
- T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.005 Visual Basic simulation — Exact active technique ID
- T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.006 Python simulation — Exact active technique ID
- T1059.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.007 JavaScript simulation — Exact active technique ID
- T1059.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090 Proxy simulation — Exact active technique ID
- T1090 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.002 External Proxy simulation — Exact active technique ID
- T1090.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1102.002 Bidirectional Communication simulation — Exact active technique ID
- T1102.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1104 Multi-Stage Channels simulation — Exact active technique ID
- T1104 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1113 Screen Capture simulation — Exact active technique ID
- T1113 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1132.001 Standard Encoding simulation — Exact active technique ID
- T1132.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1137.001 Office Template Macros simulation — Exact active technique ID
- T1137.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.004 Malicious Copy and Paste simulation — Exact active technique ID
- T1204.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1210 Exploitation of Remote Services simulation — Exact active technique ID
- T1210 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.003 CMSTP simulation — Exact active technique ID
- T1218.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.005 Mshta simulation — Exact active technique ID
- T1218.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.011 Rundll32 simulation — Exact active technique ID
- T1218.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1219.002 Remote Desktop Software simulation — Exact active technique ID
- T1219.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518 Software Discovery simulation — Exact active technique ID
- T1518 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518.001 Security Software Discovery simulation — Exact active technique ID
- T1518.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1534 Internal Spearphishing simulation — Exact active technique ID
- T1534 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1548.002 Bypass User Account Control simulation — Exact active technique ID
- T1548.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.001 Credentials In Files simulation — Exact active technique ID
- T1552.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555 Credentials from Password Stores simulation — Exact active technique ID
- T1555 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
- T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1559.001 Component Object Model simulation — Exact active technique ID
- T1559.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1559.002 Dynamic Data Exchange simulation — Exact active technique ID
- T1559.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566 Phishing simulation — Exact active technique ID
- T1566 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567.002 Exfiltration to Cloud Storage simulation — Exact active technique ID
- T1567.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1571 Non-Standard Port simulation — Exact active technique ID
- T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.001 Symmetric Cryptography simulation — Exact active technique ID
- T1573.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.001 DLL simulation — Exact active technique ID
- T1574.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.006 Web Services simulation — Exact active technique ID
- T1583.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.001 Malware simulation — Exact active technique ID
- T1588.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1590.004 Network Topology simulation — Exact active technique ID
- T1590.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1684.001 Impersonation simulation — Exact active technique ID
- T1684.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685 Disable or Modify Tools simulation — Exact active technique ID
- T1685 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModel and dependency supply-chain security
AI Security · explicit-nameMobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModel and dependency supply-chain security
AI Security · explicit-nameMobile and Android vulnerability research
Vulnerability Research & Exploit Development · explicit-name