CVE Intelligence
Home / Threat actors / MuddyWater

MuddyWater G0069

🔔 Create alert

Also known as: Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

3
associated CVEs
72
Techniques
21
Malware and tools

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2020-1472 Medium · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability
“MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).”
CVE-2020-0688 High · 8.8 KEV Ransomware Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
“MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).”
CVE-2017-0199 High · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability
“MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.”

Techniques by tactic

Reconnaissance
T1590.004 Network Topology
Resource Development
T1583.001 DomainsT1583.006 Web ServicesT1588.001 MalwareT1588.002 Tool
Initial Access
T1190 Exploit Public-Facing ApplicationT1566 PhishingT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.006 PythonT1059.007 JavaScriptT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1204.004 Malicious Copy and PasteT1559.001 Component Object ModelT1559.002 Dynamic Data ExchangeT1574.001 DLL
Persistence
T1053.005 Scheduled TaskT1137.001 Office Template MacrosT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1547.001 Registry Run Keys / Startup FolderT1548.002 Bypass User Account Control
Stealth
T1027.003 SteganographyT1027.004 Compile After DeliveryT1027.010 Command ObfuscationT1036.005 Match Legitimate Resource Name or LocationT1140 Deobfuscate/Decode Files or InformationT1218.003 CMSTPT1218.005 MshtaT1218.011 Rundll32T1574.001 DLLT1684.001 Impersonation
Defense Impairment
T1685 Disable or Modify Tools
Credential Access
T1003.001 LSASS MemoryT1003.004 LSA SecretsT1003.005 Cached Domain CredentialsT1552.001 Credentials In FilesT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers
Discovery
T1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.002 Domain AccountT1518 Software DiscoveryT1518.001 Security Software Discovery
Lateral Movement
T1210 Exploitation of Remote ServicesT1534 Internal Spearphishing
Collection
T1074.001 Local Data StagingT1113 Screen CaptureT1560.001 Archive via Utility
Command and Control
T1071.001 Web ProtocolsT1090 ProxyT1090.002 External ProxyT1102.002 Bidirectional CommunicationT1104 Multi-Stage ChannelsT1105 Ingress Tool TransferT1132.001 Standard EncodingT1219.002 Remote Desktop SoftwareT1571 Non-Standard PortT1573.001 Symmetric Cryptography
Exfiltration
T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration to Cloud Storage

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.