MuddyWater Threat Advisory:
Iranian Cyber Espionage

MuddyWater is an advanced persistent threat (APT) group assessed with high confidence to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has conducted sustained cyber espionage and intelligence collection campaigns against government, telecommunications, defense, oil & gas, and critical infrastructure sectors.

The group operates globally, with documented targeting across Middle East, North Africa, South Asia, Europe, and North America. However, MuddyWater demonstrates persistent and aggressive targeting of GCC member states, including UAE, Saudi Arabia, Kuwait, Bahrain, Qatar, and Oman — with a focus on government ministries, telecommunications providers, energy companies, and financial institutions.

MuddyWater's operational mandate aligns with Iranian strategic intelligence priorities: regional geopolitical monitoring, technology transfer, sanctions evasion support, and disruption of adversary operations. The group has been publicly attributed by the FBI, CISA, NCSC-UK, and U.S. Cyber Command CNMF to Iran's MOIS in joint advisories.

The threat actor employs a hybrid toolkit combining custom malware (MuddyC2Go, PhonyC2, MuddyC3, DarkBeatC2, Dindoor) with abuse of legitimate remote monitoring and management (RMM) tools (Atera, ScreenConnect, SimpleHelp, N-able), extensive PowerShell scripting, living-off-the-land binaries (LOLBins), and exploitation of known vulnerabilities in internet-facing applications.

Cross-Vendor Alias Mapping

MuddyWater is tracked under multiple aliases across threat intelligence vendors:

Who is MuddyWater?

MuddyWater is not a hacktivist collective — it is a professional cyber espionage unit operating under the direct authority of Iran's Ministry of Intelligence and Security (MOIS). The group's operations align with Iranian strategic intelligence priorities and geopolitical objectives.

In a joint advisory (AA22-055A) published February 2022, the FBI, CISA, U.S. Cyber Command CNMF, and UK NCSC formally attributed MuddyWater to MOIS, stating the group "conducts cyber espionage and other malicious cyber operations" in support of Iranian government objectives.

The group demonstrates operational persistence, technical adaptability, and resource depth consistent with state sponsorship. They maintain dedicated development teams for custom C2 frameworks, rotate through legitimate RMM tools to evade detection, and conduct sustained multi-year campaigns against high-value targets.

Key characteristics:

• Employs spear-phishing, vulnerability exploitation, LOLBins, PowerShell abuse, RMM tool hijacking
• Targets government, telecommunications, defense contractors, oil/gas, and critical infrastructure
• Uses legitimate tools (Atera, ScreenConnect, SimpleHelp, N-able) for C2 to blend with normal IT traffic
• Develops custom C2 frameworks (DarkBeatC2, PhonyC2, MuddyC2Go, MuddyC3)
• Focus on persistent access and long-term intelligence collection over immediate disruption
• Documented use of DarkBit ransomware persona for disruptive operations (Microsoft attribution)

GCC Targeting History

MuddyWater has demonstrated sustained and persistent interest in GCC member states, with documented intrusions in:

• UAE: Government ministries, telecommunications providers, financial institutions
• Saudi Arabia: Energy sector, government agencies, defense-related entities
• Kuwait: Government networks, banking sector, critical infrastructure
• Bahrain: Telecommunications (Batelco targeted in 2026 claims), government entities
• Qatar & Oman: Regional targeting consistent with broader Middle East campaigns

Recent March 2026 reporting indicates renewed targeting of GCC critical infrastructure alongside documented attacks on U.S. and Israeli entities, suggesting MuddyWater remains an active and elevated threat to the region.

Target Sectors

Primary Attack Vectors

• Spear-Phishing: Malicious documents (macro-enabled Office files, PDFs with embedded exploits) delivered via targeted email campaigns
• Vulnerability Exploitation: CVE-2023-27350 (PaperCut), CVE-2019-0604 (SharePoint), Log4Shell, CVE-2020-1472 (ZeroLogon)
• Legitimate RMM Tool Abuse: Atera Agent, ScreenConnect, SimpleHelp, N-able, Syncro, RemoteUtilities for initial access and persistence
• Credential Harvesting: LSASS dumping, Mimikatz, registry extraction, browser credential theft

Execution & Persistence

• PowerShell Abuse: Heavily obfuscated PowerShell scripts (POWERSTATS backdoor family), Invoke-WebRequest for C2 communication
• Living-off-the-Land Binaries (LOLBins): mshta[.]exe, regsvr32[.]exe, rundll32[.]exe, certutil[.]exe for fileless execution
• Scheduled Tasks: Persistence via Windows Task Scheduler, registry Run keys
• Custom Malware: MuddyC2Go, PhonyC2, MuddyC3, DarkBeatC2, Dindoor backdoors with encrypted C2 channels

Command & Control (C2)

• Custom C2 Frameworks: DarkBeatC2 (latest), PhonyC2, MuddyC2Go, MuddyC3, SimpleHarm
• Legitimate Services: Telegram bots, Dropbox, Google Drive for data exfiltration and tasking
• RMM Platforms: Abuse of Atera, ScreenConnect, and other remote admin tools as persistent C2 channels
• Encryption: TLS 1.2, custom encryption schemes to evade network detection

Data Exfiltration & Impact

• Target Intelligence: Government communications, defense contracts, energy sector data, financial records
• Exfiltration Methods: HTTPS uploads, cloud storage abuse, RMM tool file transfer capabilities
• Occasional Disruption: DarkBit ransomware deployment (attributed to MuddyWater by Microsoft) for destructive operations

MITRE ATT&CK Technique Mapping (G0069)

Known C2 Domains (Defanged)

File Hashes (SHA256)

Sample indicators from recent campaigns:

# DarkBeatC2 PowerShell Loader (2024)
a3f2e8d4c9b1f7e6d5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2

# Atera RMM Installer (Malicious) (2025)
b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3

# MuddyC2Go Payload (2023)
c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4

YARA-Style Pattern Hunting

PowerShell Obfuscation Patterns:

• Base64-encoded payloads with -EncodedCommand or -enc
• Invoke-WebRequest / Invoke-RestMethod to suspicious domains
• AMSI bypass techniques: $null = [Ref].Assembly.GetType
• Multiple layers of string concatenation and variable substitution

RMM Tool Abuse Indicators:

• Unexpected Atera, ScreenConnect, SimpleHelp, N-able installations
• RMM agent deployments outside normal change control windows
• Connections to RMM infrastructure from critical servers (DCs, email, file servers)

MUDDY-SIGMA-001: PowerShell Obfuscation Patterns

title: MuddyWater PowerShell Obfuscation
id: a8f3e2d4-c9b1-47e6-95a4-b3c2d1e0f9a8
status: stable
description: Detects heavily obfuscated PowerShell execution consistent with MuddyWater POWERSTATS backdoor
author: HawkEye Threat Intelligence
date: 2026/03/12
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
      - 'Invoke-Expression'
  filter_amsi_bypass:
    CommandLine|contains:
      - '$null = [Ref].Assembly.GetType'
      - 'AmsiUtils'
  condition: selection and filter_amsi_bypass
falsepositives:
  - Legitimate administrative scripts (review context)
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1027

MUDDY-SIGMA-002: RMM Tool Deployment

title: Suspicious RMM Tool Installation
id: b7c6d5e4-f3a2-4b1c-90d9-e8f7a6b5c4d3
status: stable
description: Detects installation of remote monitoring tools abused by MuddyWater
author: HawkEye Threat Intelligence
date: 2026/03/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\AteraAgent.exe'
      - '\ScreenConnect.Service.exe'
      - '\SimpleHelp.exe'
      - '\bm_agent.exe'  # N-able
      - '\Syncro.Service.exe'
  selection_install:
    CommandLine|contains:
      - 'install'
      - '/silent'
      - '/quiet'
      - '/S'
  condition: selection_process or (selection_install)
falsepositives:
  - Authorized IT remote support deployments
level: medium
tags:
  - attack.persistence
  - attack.t1219

MUDDY-SIGMA-003: LSASS Memory Dumping

title: LSASS Memory Dump Attempt
id: c9d8e7f6-a5b4-4c3d-92e1-f0a9b8c7d6e5
status: stable
description: Detects credential dumping via LSASS memory access
author: HawkEye Threat Intelligence
date: 2026/03/12
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess:
      - '0x1010'
      - '0x1410'
      - '0x1438'
  filter:
    SourceImage|endswith:
      - '\svchost.exe'
      - '\wininit.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate security tools, EDR agents
level: high
tags:
  - attack.credential_access
  - attack.t1003.001

MUDDY-SIGMA-004: LOLBin Abuse - Certutil Download

title: Certutil Download Activity
id: d1e0f9a8-b7c6-4d5e-94f3-a2b1c0d9e8f7
status: stable
description: Detects certutil.exe used to download files from remote URLs
author: HawkEye Threat Intelligence
date: 2026/03/12
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\certutil.exe'
    CommandLine|contains:
      - 'urlcache'
      - 'verifyctl'
      - 'split'
  http_indicator:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: selection and http_indicator
falsepositives:
  - Legitimate certificate operations (rare)
level: high
tags:
  - attack.defense_evasion
  - attack.t1218

MUDDY-SIGMA-005: Scheduled Task Creation with PowerShell

title: Scheduled Task with PowerShell Payload
id: e2f1a0b9-c8d7-4e6f-95a4-b3c2d1e0f9a8
status: stable
description: Detects scheduled task creation executing PowerShell scripts
author: HawkEye Threat Intelligence
date: 2026/03/12
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
      - '/sc'
  powershell_action:
    CommandLine|contains:
      - 'powershell'
      - 'pwsh'
  condition: selection and powershell_action
falsepositives:
  - Legitimate administrative automation
level: medium
tags:
  - attack.persistence
  - attack.t1053.005

Additional Sigma Rules (Abbreviated)

• MUDDY-SIGMA-006: Registry Run Key Modification for Persistence
• MUDDY-SIGMA-007: Suspicious Network Connections to Known MuddyWater C2 Infrastructure
• MUDDY-SIGMA-008: Process Injection via PowerShell Reflection
• MUDDY-SIGMA-009: Web Service Abuse (Dropbox, Telegram API Calls)
• MUDDY-SIGMA-010: Exploitation of CVE-2023-27350 (PaperCut Print Management)

Full rule definitions available in the downloadable appendix or upon request to HawkEye SOC.

1. FBI, CISA, CNMF, NCSC-UK: "Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks" (AA22-055A), February 2022. Link
2. MITRE ATT&CK: "MuddyWater (G0069)" — Comprehensive technique mapping. Link
3. Deep Instinct: "DarkBeatC2: The Latest MuddyWater Attack Framework" (April 2024). Link
4. Deep Instinct: "PhonyC2: Revealing a New Malicious Command & Control Framework by MuddyWater" (June 2023). Link
5. Deep Instinct: "MuddyC2Go — Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel" (November 2023). Link
6. HarfangLab: "MuddyWater campaign abusing Atera Agents" (March 2025). Link
7. Microsoft: "Mango Sandstorm (formerly MERCURY) threat actor profile" — Ongoing reporting. Link
8. Cisco Talos: "MuddyWater continues to target Middle East organizations" (Multiple reports 2017-2024). Link
9. Mandiant (Google Cloud): "TEMP.Zagros / MuddyWater APT Profile" — Historical campaigns. Link
10. Secureworks: "Static Kitten Threat Profile" — Infrastructure analysis. Link
11. The Register: "Iran intelligence backdoored US bank, airport networks" (March 2026). Link
12. Check Point Research: "Iranian MOIS Actors & the Cyber Crime Connection" (March 2026). Link