MuddyWater G0069

Também conhecido como: Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

CVEs associadas

Técnicas

Malwares e ferramentas

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2020-1472 Média · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability

“MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).”

CVE-2020-0688 Alta · 8.8 KEV Ransomware Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

“MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).”

CVE-2017-0199 Alta · 7.8 KEV Ransomware Microsoft Office and WordPad Remote Code Execution Vulnerability

“MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.”

Técnicas por tática

Reconhecimento

T1590.004 Network Topology

Desenvolvimento de recursos

T1583.001 Domains T1583.006 Web Services T1588.001 Malware T1588.002 Tool

Acesso inicial

T1190 Exploit Public-Facing Application T1566 Phishing T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1204.004 Malicious Copy and Paste T1559.001 Component Object Model T1559.002 Dynamic Data Exchange T1574.001 DLL

Persistência

T1053.005 Scheduled Task T1137.001 Office Template Macros T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1547.001 Registry Run Keys / Startup Folder T1548.002 Bypass User Account Control

Furtividade

T1027.003 Steganography T1027.004 Compile After Delivery T1027.010 Command Obfuscation T1036.005 Match Legitimate Resource Name or Location T1140 Deobfuscate/Decode Files or Information T1218.003 CMSTP T1218.005 Mshta T1218.011 Rundll32 T1574.001 DLL T1684.001 Impersonation

Comprometimento de defesas

T1685 Disable or Modify Tools

Acesso a credenciais

T1003.001 LSASS Memory T1003.004 LSA Secrets T1003.005 Cached Domain Credentials T1552.001 Credentials In Files T1555 Credentials from Password Stores T1555.003 Credentials from Web Browsers

Descoberta

T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1518 Software Discovery T1518.001 Security Software Discovery

Movimento lateral

T1210 Exploitation of Remote Services T1534 Internal Spearphishing

Coleta

T1074.001 Local Data Staging T1113 Screen Capture T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1090 Proxy T1090.002 External Proxy T1102.002 Bidirectional Communication T1104 Multi-Stage Channels T1105 Ingress Tool Transfer T1132.001 Standard Encoding T1219.002 Remote Desktop Software T1571 Non-Standard Port T1573.001 Symmetric Cryptography

Exfiltração

T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

FooderMalwareS9033
LP-NotesMalwareS9036
MoriMalwareS1047
MuddyViperMalwareS9032
POWERSTATSMalwareS0223
PowGoopMalwareS1046
RustyWaterMalwareS9037
SHARPSTATSMalwareS0450
Small SieveMalwareS1035
STARWHALEMalwareS1037
Tsundere BotnetMalwareS9034
ConnectWiseFerramentaS0591
CrackMapExecFerramentaS0488
EmpireFerramentaS0363
KoadicFerramentaS0250
LaZagneFerramentaS0349
MimikatzFerramentaS0002
Out1FerramentaS0594
PowerSploitFerramentaS0194
RcloneFerramentaS1040
RemoteUtilitiesFerramentaS0592