IRIran (Islamic Republic of)confidence: 50G0069
MuddyWaterMuddyWater
Also known as: TEMP.Zagros · Static Kitten · Seedworm · MERCURY · COBALT ULSTER · G0069 · ATK51 · Boggy Serpens · Mango Sandstorm · TA450 · Earth Vetala · MuddyWater
Origin
IR
Known aliases
12
Target sectors
1
Attribution
State-sponsored
Profile
The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.
Aliases· 12
TEMP.ZagrosStatic KittenSeedwormMERCURYCOBALT ULSTERATK51Boggy SerpensMango SandstormTA450Earth VetalaMuddyWater
Target sectors· 1
Government
Known victims· 9
- Saudi Arabia
- Georgia
- Turkey
- Iraq
- Israel
- India
- United Arab Emirates
- Pakistan
- United States
MITRE ATT&CK Group crosswalk
Compliance frameworks requiring this (incoming)1
| Type | Target | Confidence | Tier |
|---|---|---|---|
| ComplianceControl | pci_dss_v4-r12 | 100% | live |
References
- https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/
- https://www.cfr.org/interactive/cyber-operations/muddywater
- https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html
- https://blog.trendmicro.com/trendlabs-security-intelligence/campaign-possibly-connected-muddywater-surfaces-middle-east-central-asia/
- https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/
- https://securelist.com/muddywater/88059/
- https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group
- https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.