MuddyWater Tracker: What the Public Record Shows (2017-2026)

An Iranian Ministry of Intelligence and Security (MOIS) cyber espionage group that Palo Alto Networks tracks as "Boggy Serpens". It targets governments, diplomats, energy, maritime, telecom and finance across the Middle East and beyond. This page collects what CISA, MITRE ATT&CK and primary vendor research have established through 2026.

State of Surveillance

TL;DR: MuddyWater is a cyber espionage group the joint CISA/FBI/CNMF/NSA/UK NCSC advisory AA22-055A (February 24, 2022) calls "a subordinate element within the Iranian Ministry of Intelligence and Security (MOIS)" that has run broad campaigns "since approximately 2018" [1]. MITRE ATT&CK tracks it as group G0069 with aliases Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450 and MuddyKrill, active "since at least 2017" and last updated July 31, 2026 [2]. Palo Alto Networks' Unit 42 calls the same actor "Boggy Serpens" and published a threat assessment with a 19-minute read time on March 16, 2026, documenting live activity against Israel, Hungary, Turkey, Saudi Arabia, the UAE, Turkmenistan, Egypt, Azerbaijan, Oman and South America [3]. The advisory list of named malware is long and growing: PowGoop, Small Sieve, Canopy/Starwhale, Mori, POWERSTATS from the CISA advisory [1], plus LampoRAT/Olalampo, BlackBeard, Phoenix v4/Mononoke, Nuso, UDPGangster, GhostBackDoor and BugSleep from Unit 42 [3]. Unit 42 describes the group's core method as "trusted relationship compromises" that hijack internal mailboxes to bypass reputation-based filtering [3]. MITRE ATT&CK separately documents the group using commercial Starlink satellite internet for command and control [2]. This tracker summarizes the public record through October 2026 and is updated as new advisories appear.

What MuddyWater Actually Is

MuddyWater is a label for an Iranian MOIS-linked cyber espionage group, not a single hacker. CISA's joint advisory AA22-055A calls it "a subordinate element within the Iranian Ministry of Intelligence and Security (MOIS)" and says the group "has conducted broad cyber campaigns in support of MOIS objectives since approximately 2018" [1]. MITRE ATT&CK dates the group's earliest tracked activity to at least 2017 and lists the industry aliases as Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450 and MuddyKrill [2]. The CISA advisory adds five of those aliases (Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros) and binds them to the same actor [1]. Palo Alto Networks' Unit 42 tracks the same activity as "Boggy Serpens" [3].

Two things made MuddyWater distinct from the typical APT profile. First, the target list. AA22-055A documents targeting across "telecommunications, defense, local government, and oil and natural gas" in "Asia, Africa, Europe, and North America" [1]. The Unit 42 March 16, 2026 assessment extends the geographic and sector reach: government and military, diplomatic, critical infrastructure (energy and maritime), finance, aviation, telecommunications and IT vendors across Israel, Hungary, Turkey, Saudi Arabia, the UAE, Turkmenistan, Egypt, Azerbaijan, Oman and South America [3]. The MITRE ATT&CK group page adds finance and Middle East country names, including the UAE and Saudi Arabia, on top of the CISA list [2]. Second, the tradecraft. The CISA advisory documents the group as "positioned both to provide stolen data and accesses to the Iranian government and to share these with other malicious cyber actors" [1]. Unit 42's assessment calls the same behavior "trusted relationship compromises" and describes MuddyWater using generative AI to write code and accelerate the creation of new malware variants [3].

What is not stated in any of the three primary sources is the precise relationship between MuddyWater and the MOIS. CISA calls it "subordinate" but does not describe a parent organization or a chain of command [1]. Unit 42's threat assessment repeats the "subordinate element of the MOIS" language [3]. The CISA advisory frames the group as a "subordinate element" without naming the MOIS unit, internal directorate, or contracting arrangement.

Publicly Reported Victims

The publicly disclosed picture is partial. MuddyWater's tradecraft is built to avoid detection, and government advisories describe victims by sector rather than by company name. Each entry below states who reported it and how firmly.

Turkmenistan Telecommunications Provider (January 2026)

The Unit 42 assessment documents a January 6, 2026 attack against "a major telecommunications provider in Turkmenistan" [3]. The operators compromised an internal account rather than spoofing an external address. The Turkmenistan provider is not named in the assessment.

Omani Ministry of Foreign Affairs

Unit 42 documents mailbox hijacking at the Omani Ministry of Foreign Affairs [3]. The assessment dates the compromise to August 2025, when the hijacked mailbox was used to send purported diplomatic documents to foreign ministries. The ministry's name is the only attribution.

Middle East Energy and Marine Services Company

Unit 42 documents an attack against "an energy and marine services company in the Middle East," described as "a high-value industrial entity with significant ties to the local sovereign establishment" [3]. The assessment does not name the company or the country. The tradecraft described (multi-wave persistence, hijacked internal mailboxes, file-association persistence) is consistent with the January 30, 2026 "Wave 2" Excel financial lure and February 11, 2026 "Consumption Report" Excel documented in the same assessment [3].

Israeli Organizations, Including Technion (February 2023)

Unit 42 documents MuddyWater activity against Israeli organizations including the Technion Israel Institute of Technology, which the assessment describes as a February 2023 intrusion masquerading as the DarkBit ransomware [3]. INCD (the Israel National Cyber Directorate) reporting cited in the same assessment describes additional Israeli targets [3]. The Technion event is the most firmly dated Israeli victim in the public record.

Sectors Hit (Per AA22-055A and Unit 42)

CISA's advisory lists telecommunications, defense, local government, and oil and natural gas as the sectors MuddyWater has targeted across Asia, Africa, Europe and North America [1]. The Unit 42 assessment adds government and military, critical infrastructure (energy and maritime), finance, aviation, telecommunications and IT vendors across the broader Middle East and Europe [3]. MITRE ATT&CK adds finance as a sector and the UAE and Saudi Arabia as named Middle East targets [2].

The Playbook: How MuddyWater Gets In And Stays In

The three primary sources describe a tradecraft that has shifted from opportunistic phishing to hijacked-trusted-relationship lures. The core entry vectors and techniques:

  • Spear phishing with hijacked internal accounts. Unit 42 documents "trusted relationship compromises": phishing emails sent from compromised internal or trusted accounts so they bypass reputation-based filtering [3]. The same assessment describes "blurred-document lures requiring 'Enable Content'" and VBA macro payloads that drop and rename an executable (for example, "novaservice.txt" to "novaservice.exe") [3]. AA22-055A lists spearphishing attachment and spearphishing link as the initial-access techniques [1].
  • PowerShell, Python and VBA for execution. The CISA advisory lists T1059.001 (PowerShell), T1059.006 (Python), T1059.007 (JavaScript) and T1059.005 (Visual Basic) as the execution techniques; Small Sieve is delivered as a Python backdoor via an NSIS installer named "gram_app.exe" [1]. MITRE ATT&CK also lists Office Template Macros (T1137.001) under persistence and User Execution: Malicious File (T1204.002) under execution [2].
  • Living off the land plus a custom backdoor family. Unit 42 documents MuddyWater "abusing legitimate remote monitoring and management (RMM) tools like Atera, ScreenConnect and SimpleHelp" [3]. AA22-055A documents abuse of ConnectWise, RemoteUtilities and ScreenConnect for the same purpose [1]. MuddyWater also uses a custom C++ backdoor family. The Unit 42 assessment names LampoRAT (also called Olalampo), BlackBeard, Phoenix v4 (also called Mononoke), Nuso (also called HTTP_VIP), UDPGangster, GhostBackDoor and BugSleep as the custom malware observed [3]. The CISA advisory names PowGoop (a DLL loader and PowerShell-based downloader), Small Sieve, Canopy/Starwhale, Mori and POWERSTATS [1]. MITRE ATT&CK also lists CrackMapExec (S0488), Empire (S0363), Koadic (S0250), Mimikatz (S0002), PowerSploit (S0194), Rclone (S1040), SHARPSTATS (S0450), DCHSpy (S1243), Fooder, MuddyViper, Tsundere Botnet, RustyWater and LP-Notes as associated software [2].
  • Defense evasion, including AI-assisted code. Unit 42 documents MuddyWater using generative AI to write code and accelerate the creation of new malware variants, evidenced by emoji-based status indicators in the malware [3]. The same assessment documents a C++ dropper with Fibonacci-based CPU delays and a VBA time loop that the assessment says exceeds 100 million operations [3]. AA22-055A documents DLL side-loading (T1574.002), Invoke-Obfuscation, Base64 and CMSTP/Mshta/Rundll32 abuse [1].
  • Credential dumping with off-the-shelf tools. AA22-055A documents use of LaZagne, Mimikatz and procdump64.exe to dump credentials, and Browser64 to steal passwords from web browsers [1]. MITRE ATT&CK lists the same credential-access techniques: T1003.001 (LSASS), T1003.004 (LSA Secrets) and T1552.001 (credentials in files), plus T1555.003 (credentials from web browsers) [2].
  • Telegram and DNS for command and control. AA22-055A documents the Small Sieve backdoor using the Telegram Bot API for C2, with a Telegram Channel ID of "2090761833" and a compile time of "2021-09-25 21:57:46 UTC" [1]. The same advisory documents the Mori backdoor using DNS tunneling for C2 [1]. Unit 42 documents a Telegram bot token of "8398566164:AAEJbk6EOirZ_ybm4PJ-q8mOpr1RkZx1H7Q" and a bot username of "stager_51_bot" with the display name "Olalampo" [3]. The same Unit 42 assessment documents HTTP status code-based C2 commands using 201/204, 210/222, 350/404 and 418 codes [3]. AES-256-GCM encryption is used for exfiltration [3].
  • Commercial Starlink satellite internet for C2. MITRE ATT&CK documents: "In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication" [2]. The MITRE page lists domain reuse dating to October 2025 and a hosting preference for NameCheap and Hosterdaddy Private Limited (AS136557) [2].
  • Process hollowing, WMI lateral execution, and persistence quirks. Unit 42 documents dynamic API resolution and RunPE process hollowing, WMI (Win32_Process.Create) for lateral execution, and a custom file-association persistence using the ".wdlp" extension [3]. AA22-055A documents registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OutlookMicrosift for Small Sieve) and scheduled tasks for persistence [1]. MITRE ATT&CK documents "MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware" [2].
  • Specific CVEs exploited early in the campaign. AA22-055A documents MuddyWater exploiting the Microsoft Netlogon elevation of privilege vulnerability (CVE-2020-1472) and the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688) [1]. The advisory was published February 24, 2022 and describes "recent" exploitation of both vulnerabilities [1].
  • ClickFix social engineering. MITRE ATT&CK lists T1204.004 (ClickFix) as one of the user-execution techniques [2]. The group page describes victims being enticed to copy and paste malicious PowerShell code, a ClickFix-style tactic.
  • Exfiltration to Wasabi cloud storage. MITRE ATT&CK documents MuddyWater using Rclone (S1040) to exfiltrate data to Wasabi cloud storage via T1567.002 [2].
  • Small Sieve command-line guardrail. AA22-055A documents that the Small Sieve payload "will only execute correctly if the word 'Platypus' is passed to it on the command line" [1]. The UK NCSC and US agencies state they "attribute Small Sieve to MuddyWater with high confidence" [1].
  • Iranian standard-time operating rhythm. Unit 42 documents live threat-actor activity "at ~07:30 CST (17:00 Iranian standard time)," with manual reconnaissance commands following automated infection, which the assessment reads as "human-led triage" rather than fully automated operations [3].

The defensive lesson from the three sources is consistent. Patch internet-facing appliances (especially Microsoft Exchange) and use phishing-resistant MFA on every account that supports it. AA22-055A's recommended mitigations include deploying application control, using MFA on webmail and VPN, limiting administrator privileges, enabling and updating antivirus, training users to recognize phishing, and adopting threat reputation services for email, URL and IP filtering [1]. Unit 42's assessment describes "parallel tracks that ensure the redundancy needed to sustain a high operational tempo" [3], which means a single defensive control is rarely enough.

Who Runs MuddyWater

CISA, the FBI, NSA, CNMF and the UK NCSC attribute MuddyWater to the Iranian MOIS [1]. The CISA advisory states the group is "positioned both to provide stolen data and accesses to the Iranian government and to share these with other malicious cyber actors" [1]. MITRE ATT&CK repeats the "subordinate element within Iran's Ministry of Intelligence and Security (MOIS)" attribution [2]. Unit 42's threat assessment repeats the same attribution and calls the actor "a subordinate element of the MOIS" [3]. Iran has not, in the public record through October 2026, acknowledged MuddyWater or the MOIS link.

What is not stated in any of the three primary sources is the MOIS unit or directorate that oversees MuddyWater, the size of the operator pool, or any contracting arrangement with a private Iranian firm. The CISA advisory frames the group as "subordinate" without naming a parent organization or a chain of command beyond the MOIS itself [1].

What You Can Do If MuddyWater Touches Your Network

For organizations that find MuddyWater activity, AA22-055A lists specific mitigations and incident-response steps [1]:

  • Deploy application control software. Restrict what can run on user endpoints and servers [1].
  • Use multifactor authentication, especially on webmail, VPN and critical systems. Phishing-resistant MFA (FIDO2, hardware security keys, passkeys) closes the credential-access step MuddyWater relies on [1].
  • Limit administrator privileges. Local admin rights should be the exception, not the default [1].
  • Patch Microsoft Exchange and Windows Netlogon immediately. CVE-2020-0688 and CVE-2020-1472 are the CVEs the CISA advisory specifically names as exploited [1].
  • Train users to recognize phishing. Spear-phishing attachments and links remain the most common MuddyWater initial-access technique [1].
  • Adopt threat reputation services. Email, URL and IP filtering against known-bad infrastructure [1].
  • Audit for the Small Sieve registry persistence key. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OutlookMicrosift is the CISA-documented Small Sieve persistence mechanism, and verify Small Sieve only executes when "Platypus" is on the command line [1].
  • Watch for Starlink and Wasabi traffic. MITRE ATT&CK documents commercial Starlink C2 (late 2025 to early 2026) and Rclone exfiltration to Wasabi cloud storage (T1567.002) [2].
  • Hunt for the Telegram bot tokens and bot usernames. The Unit 42 assessment names the bot token "8398566164:AAEJbk6EOirZ_ybm4PJ-q8mOpr1RkZx1H7Q" and the bot username "stager_51_bot" with the display name "Olalampo" [3].
  • Report to authoring agencies. AA22-055A's reporting channel list: FBI's 24/7 Cyber Watch line at (855) 292-3937, CISA Central at [email protected], or the local FBI field office [1]. Outside the US, the advisory points UK organizations to ncsc.gov.uk/report-an-incident or to the NCSC's urgent assistance line, 03000 200 973.

For IT and security leads, the single highest-impact change is enforcing phishing-resistant MFA on every account that supports it. The second highest-impact change is patching Microsoft Exchange against CVE-2020-0688 and Windows Netlogon against CVE-2020-1472 if you have not already. MuddyWater's tradecraft leans heavily on hijacked internal mailboxes and stolen credentials, and both controls close that door.

The Honest Takeaway

MuddyWater is what a state-aligned espionage crew looks like when it gets a working strategy for trusted-relationship compromise. The three primary sources are the public accounting: the CISA joint advisory AA22-055A for the foundational malware list and CVEs, MITRE ATT&CK G0069 for the canonical alias list and 2026 infrastructure changes (Starlink C2, Wasabi exfiltration, ClickFix social engineering), and the Unit 42 Boggy Serpens threat assessment for the 2026 victim list and AI-assisted code generation [1][2][3]. The hijacked-internal-mailbox phishing, the Telegram C2, the C++ dropper with Fibonacci-based CPU delays, the multi-wave persistence against single targets, and the live activity timed to 17:00 Iranian standard time are the operational fingerprint.

What does not change is the playbook. Hijacked mailboxes that bypass reputation filtering. Spear phishing with blurred-document lures that require "Enable Content." VBA macros that drop and rename an executable. Custom backdoors (LampoRAT, BlackBeard, Phoenix v4, Nuso, UDPGangster, GhostBackDoor, BugSleep) layered with off-the-shelf remote-access tools (Atera, ScreenConnect, SimpleHelp). Credential dumping with Mimikatz, LaZagne and procdump64.exe. The defensive lesson is the same one every advisory writes: phishing-resistant MFA, application control, least privilege, prompt patching of internet-facing systems, and a tested incident response plan [1][3].

This tracker will be updated as new advisories appear and named victims are confirmed.

Sources

  1. CISA, FBI, CNMF, NSA, UK NCSC, Iranian Government-Sponsored Actors Conduct Cyber Operations (AA22-055A, February 24, 2022)
  2. MITRE ATT&CK, MuddyWater (G0069), last modified July 31, 2026
  3. Unit 42 Palo Alto Networks, Boggy Serpens Threat Assessment (March 16, 2026)

Published: October 18, 2026