MuddyWater
Also known as: Static Kitten, Seedworm, MERCURY, Mango Sandstorm, TEMP.Zagros
MuddyWater runs broad phishing campaigns and frequently abuses legitimate remote monitoring and management (RMM) tools, so its access looks like normal IT support activity. It is also known for PowerShell-based malware and for exploiting public-facing applications.
- Public attribution
- Publicly attributed by US and UK agencies as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS).
- Active since
- Around 2017
- Targets
- Government and telecommunications
- Defence, oil and natural gas
- The Middle East, Asia, Africa, Europe and North America
Notable campaigns
2022US and UK joint advisory
FBI, CISA, US Cyber Command and the UK NCSC described the group's use of malware such as PowGoop, Small Sieve and POWERSTATS (AA22-055A).
Signature ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1566.002Phishing: Spearphishing Link
- T1219.002Remote Access Tools: Remote Desktop Software
- T1059.001Command and Scripting Interpreter: PowerShell
- T1218.011System Binary Proxy Execution: Rundll32
- T1003.001OS Credential Dumping: LSASS Memory
- T1190Exploit Public-Facing Application
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Allowlist approved remote access tools and block or alert on any others.
- Enable PowerShell script block logging and constrained language mode where possible.
- Block links to file-sharing services in email for users who do not need them.
- Patch public-facing applications and remove unused ones.