MuddyWater
threat actorIRalso known as
Other names and identifiers for this entity.
ATT&CK
Earth Vetala · MERCURY · Mango Sandstorm · MuddyKrill · MuddyWater · Seedworm · Static Kitten · TA450 · TEMP.Zagros
MISP
ATK51 · Boggy Serpens · COBALT ULSTER · Earth Vetala · MERCURY · MUDDY ION · MUDDYCOAST · Mango Sandstorm · MuddyWater · Seedworm · Static Kitten · TA450 · TEMP.Zagros
The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.
resolved ATT&CK groups
Threat groups associated with this.
techniques used (68)
ATT&CK techniques this enables or maps to.
software used (22)
Malware and tools associated with this.
references
External citations — patches, advisories, analysis.
- https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/
- https://www.cfr.org/interactive/cyber-operations/muddywater
- https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html
- https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/
- https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/
- https://securelist.com/muddywater/88059/
- https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group
- https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf