Skip to content

MuddyViper

Software · ATTACK:enterprise:S9032

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S9032",
  "title": "MuddyViper",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S9032",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--7b92e996-b535-4159-be16-3c3aee4edf54",
  "external_id": "S9032",
  "domain": "enterprise",
  "created": "2026-04-20T17:41:52.695Z",
  "modified": "2026-04-23T03:31:49.616Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "ESET_MuddyWater_Dec2025",
      "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
    }
  ]
}

Explicit source assertions (19)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:S9032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ac9555c-10d1-450e-ba4e-6dd89a6a0624

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--105235ae-d06d-47ed-8eea-8237bd1d7397

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b19ae5d-f4c5-4962-a069-3d264ff1a80d

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25725116-788a-429a-b026-a6345bbd7f25

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38848a62-c389-4344-8bed-094292cef803

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ef8c5fb-1c73-4847-9aa0-0d83eec44993

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c962e5a-d3fc-48e4-b8a4-24e3172a9ce0

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f387fdf-8d1f-4098-864c-c674277ad9da

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--608f52ab-6b29-4157-8fda-5dc6be80c2c0

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77811f16-814c-45e5-b922-1b2be86239d3

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ac875db-8d72-416b-93cf-2712d376d84e

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1056.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ead2d52-702b-4894-a27d-755e6bd68d32

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a20f619e-7d6d-48c1-a492-151152470f18

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8bf6c5d-6201-4d5e-883f-4818d721e247

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adbb3959-724e-4219-bf4f-eb527b191baf

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d52caf16-afeb-4718-aca6-ff7bf5e8645d

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8133f0a-2f24-4697-b5f5-3a0d60c6b3dd

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0537919-94ba-4f00-85b4-6344b3607eb6

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e888ca4d-7970-4f35-a7f1-a2f9a14b2f22

ESET_MuddyWater_Dec2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.