POWERSTATS
Software · ATTACK:enterprise:S0223
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0223",
"title": "POWERSTATS",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0223",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--e8545794-b98c-492b-a5b3-4b5a02682e37",
"external_id": "S0223",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2025-04-16T20:38:40.984Z",
"version": "2.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Powermud"
},
{
"source_name": "POWERSTATS"
},
{
"source_name": "ClearSky MuddyWater Nov 2018",
"url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
},
{
"source_name": "Unit 42 MuddyWater Nov 2017",
"url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"
},
{
"source_name": "Symantec MuddyWater Dec 2018",
"url": "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
}
]
}Explicit source assertions (28)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1559.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--048df7c4-96b0-4b76-9e21-f9ad70a2ce9b
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1477187e-7bd8-4622-8c2d-e5978c1fd29f
ClearSky MuddyWater Nov 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1567eaca-2b2e-44df-b447-87769738e00a
TrendMicro POWERSTATS V3 June 2019ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ccf654b-1077-4277-9a24-099fb3bf095f
ClearSky MuddyWater Nov 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d1bee29-c394-48ca-8ded-21fd86e3ff43
FireEye MuddyWater Mar 2018ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:S0223
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31433bb4-aa47-444a-b7d7-49208401e974
Unit 42 MuddyWater Nov 2017 · FireEye MuddyWater Mar 2018 · ClearSky MuddyWater Nov 2018 · Symantec MuddyWater Dec 2018 · ClearSky MuddyWater June 2019ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3caf848c-d95b-40ae-a288-2905319e4005
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cd0e385-3c60-4742-b3a6-c07dbf10ba45
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42cc506f-e9c2-43f1-a68f-3c6973cca2dc
FireEye MuddyWater Mar 2018 · ClearSky MuddyWater Nov 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44671cd3-9bdd-4e9f-a7d1-a322d0abf659
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e88ec20-d309-440d-a685-0d2abdc1d7ef
FireEye MuddyWater Mar 2018 · TrendMicro POWERSTATS V3 June 2019ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f9916d0-70c3-4504-93cf-cd0e8dd7ead1
Unit 42 MuddyWater Nov 2017ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1090.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fb86c58-666c-4a5f-bdd1-417a77761e6f
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84a213fc-604f-441f-ba18-feab32085a50
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--911c0e63-10bc-4fbd-b7b7-0a9e318bb4f1
ClearSky MuddyWater Nov 2018 · DHS CISA AA22-055A MuddyWater February 2022 · Unit 42 MuddyWater Nov 2017 · TrendMicro POWERSTATS V3 June 2019ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--927e8d82-d094-4170-bc76-10717ffd8d7f
FireEye MuddyWater Mar 2018 · TrendMicro POWERSTATS V3 June 2019ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9dcc9cb1-d489-42ab-b647-3a492c04c114
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9eee0829-17ee-4fe4-8adb-ca1ab463f4d2
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b853cee3-a145-407f-83fe-dd52c4efbe2f
ClearSky MuddyWater Nov 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baeff271-0885-4c44-a9d6-c03411ca9bb0
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baf31b81-e175-49e3-b2d9-d7552ea902a1
ClearSky MuddyWater Nov 2018 · TrendMicro POWERSTATS V3 June 2019 · FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c18652f6-e25c-4e01-bec2-04204a50cf23
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5d09de5-7a1e-45b5-a7ac-1637e8fe8eff
ClearSky MuddyWater Nov 2018 · TrendMicro POWERSTATS V3 June 2019ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb36459a-d37c-424f-8130-55cf8d29417e
ClearSky MuddyWater Nov 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce7b27ac-fff6-4d3c-bceb-50c16f462552
FireEye MuddyWater Mar 2018ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e93c8f61-b2c9-4877-8c2c-12bd37aa5a87
FireEye MuddyWater Mar 2018 · TrendMicro POWERSTATS V3 June 2019ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1027.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee47ad7d-0c85-46fb-a4f7-047fdff09a03
TrendMicro POWERSTATS V3 June 2019ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff3b4b17-7d3f-43a9-8e9a-ce56909da725
TrendMicro POWERSTATS V3 June 2019