MuddyWater

{
  "id": "ATTACK:mobile:G0069",
  "title": "MuddyWater",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0069",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--269e8108-68c6-4f99-b911-14b2e765dec2",
  "external_id": "G0069",
  "domain": "mobile",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2026-07-31T20:48:29.347Z",
  "version": "7.0",
  "aliases": [
    "MuddyWater",
    "Earth Vetala",
    "MERCURY",
    "Static Kitten",
    "Seedworm",
    "TEMP.Zagros",
    "Mango Sandstorm",
    "TA450",
    "MuddyKrill"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Cloudflare 2026 Threat Report New Threat Actors March 2026",
      "url": "https://blog.cloudflare.com/2026-threat-report/"
    },
    {
      "source_name": "MERCURY"
    },
    {
      "source_name": "Static Kitten"
    },
    {
      "source_name": "MuddyKrill"
    },
    {
      "source_name": "TEMP.Zagros"
    },
    {
      "source_name": "Mango Sandstorm"
    },
    {
      "source_name": "TA450"
    },
    {
      "source_name": "Seedworm"
    },
    {
      "source_name": "Earth Vetala"
    },
    {
      "source_name": "MuddyWater"
    },
    {
      "source_name": "ClearSky MuddyWater Nov 2018",
      "url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
    },
    {
      "source_name": "ClearSky MuddyWater June 2019",
      "url": "https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"
    },
    {
      "source_name": "CYBERCOM Iranian Intel Cyber January 2022",
      "url": "https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"
    },
    {
      "source_name": "ESET_MuddyWater_Dec2025",
      "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
    },
    {
      "source_name": "FalconFeeds_Iran_Mar2026",
      "url": "https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict"
    },
    {
      "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
      "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
    },
    {
      "source_name": "Huntio_IranInfra_Mar2026",
      "url": "https://hunt.io/blog/iranian-apt-infrastructure-state-aligned-clusters"
    },
    {
      "source_name": "Unit 42 MuddyWater Nov 2017",
      "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"
    },
    {
      "source_name": "Talos MuddyWater Jan 2022",
      "url": "https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"
    },
    {
      "source_name": "Anomali Static Kitten February 2021",
      "url": "https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Proofpoint TA450 Phishing March 2024",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"
    },
    {
      "source_name": "NaumaanProofpoint_GlobalClickFix_April2025",
      "url": "https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"
    },
    {
      "source_name": "Trend Micro Muddy Water March 2021",
      "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
    },
    {
      "source_name": "Reaqta MuddyWater November 2017",
      "url": "https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"
    },
    {
      "source_name": "FireEye MuddyWater Mar 2018",
      "url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
    },
    {
      "source_name": "Symantec MuddyWater Dec 2018",
      "url": "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
    },
    {
      "source_name": "SymantecCarbonBlack_Seedworm_Mar2026",
      "url": "https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us"
    }
  ]
}