MuddyWater — Threat Actors — SecurityStudies.info

News fetched Nov 13, 00:01 UTC

Cyber threats / Threat actors

Profile

Also known as: ATK51, Boggy Serpens, COBALT ULSTER, Earth Vetala, G0069, Mango Sandstorm, MERCURY, MUDDY ION, MUDDYCOAST, MuddyKrill, Seedworm, Static Kitten, TA450, TEMP.Zagros

The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.

ATT&CK techniques · 68

Reconnaissance

T1590.004Network Topology

Resource Development

T1583.001Domains T1583.006Web Services T1588.001Malware T1588.002Tool

Initial Access

T1190Exploit Public-Facing Application T1566Phishing T1566.001Spearphishing Attachment T1566.002Spearphishing Link

Execution

T1047Windows Management Instrumentation T1053.005Scheduled Task T1059.001PowerShell T1059.003Windows Command Shell T1059.005Visual Basic T1059.006Python T1059.007JavaScript T1203Exploitation for Client Execution T1204.001Malicious Link T1204.002Malicious File T1204.004Malicious Copy and Paste T1559.001Component Object Model T1559.002Dynamic Data Exchange T1574.001DLL

Persistence

T1137.001Office Template Macros T1547.001Registry Run Keys / Startup Folder

Privilege Escalation

T1548.002Bypass User Account Control

Stealth

T1027.003Steganography T1027.004Compile After Delivery T1027.010Command Obfuscation T1036.005Match Legitimate Resource Name or Location T1140Deobfuscate/Decode Files or Information T1218.003CMSTP T1218.005Mshta T1218.011Rundll32 T1684.001Impersonation

Defense Impairment

T1685Disable or Modify Tools

Credential Access

T1003.001LSASS Memory T1003.004LSA Secrets T1003.005Cached Domain Credentials T1552.001Credentials In Files T1555Credentials from Password Stores T1555.003Credentials from Web Browsers

Discovery

T1016System Network Configuration Discovery T1033System Owner/User Discovery T1049System Network Connections Discovery T1057Process Discovery T1082System Information Discovery T1083File and Directory Discovery T1087.002Domain Account T1518Software Discovery T1518.001Security Software Discovery

Lateral Movement

T1210Exploitation of Remote Services T1534Internal Spearphishing

Collection

T1074.001Local Data Staging T1113Screen Capture T1560.001Archive via Utility

Command and Control

T1071.001Web Protocols T1090Proxy T1090.002External Proxy T1102.002Bidirectional Communication T1104Multi-Stage Channels T1105Ingress Tool Transfer T1132.001Standard Encoding T1219.002Remote Desktop Software T1571Non-Standard Port T1573.001Symmetric Cryptography

Exfiltration

T1041Exfiltration Over C2 Channel T1567.002Exfiltration to Cloud Storage

Incidents attributed

No incident in the register is attributed to this actor.

In the news

Updated Cyber Threat Actor Naming System
Google Threat Intelligence · Jul 24, 2026

Targets

Elsewhere: United Arab Emirates, Georgia, Israel, Iraq, Pakistan, Saudi Arabia, Türkiye, United States

Sectors: Government

Relevance to the EU

EU relevance: Low

No EU member state among its known victims and no overlap with EU projects

9 EU cooperation projects in the Asia-Pacific countries this actor targets:

Infrastructure & Transport

2

Development Cooperation

2

Trade & Investment

1

Peace & Security

1

Research & Innovation

1

Education & Skills

1

Climate & Environment

1

Threats to the EU →

References

Sources: MISP, MITRE