{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "muddywater",
    "slug": "muddywater",
    "name": "MuddyWater",
    "shortName": "MuddyWater",
    "country": "Iran",
    "countryCode": "IR",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2017",
    "prominence": 83,
    "mitreGroupId": "G0069",
    "malpediaSlug": "muddywater",
    "tagline": "Iran's Ministry of Intelligence, named as such by U.S. Cyber Command. Runs espionage almost entirely on legitimate remote-management software.",
    "bio": "MuddyWater is the operational arm of Iran's Ministry of Intelligence and Security (MOIS), formally identified as such by U.S. Cyber Command in January 2022 — an unusually direct attribution from a military command.\n\nIts defining tradecraft choice is the near-total avoidance of custom malware. Rather than deploying implants, the group installs legitimate commercial remote monitoring and management software — Atera, ScreenConnect, SimpleHelp, RemoteUtilities, Syncro — on victim machines. These are signed, reputable products that thousands of organisations run legitimately. Antivirus does not flag them, EDR does not alert on them, and an analyst reviewing installed software sees a plausible IT tool. Everything that follows happens over an approved, encrypted commercial channel.\n\nDelivery is correspondingly simple: phishing from compromised legitimate mailboxes at real organisations, often ones the group breached earlier in the same campaign, so the sender's reputation and domain are genuine.\n\nTargeting spans government, telecommunications, energy, and defence across the Middle East, with regular reach into Europe, North America, and Asia. Israeli and Gulf state targets have featured heavily, and activity against Israeli organisations increased sharply after October 2023.\n\nThe group has also been used as a delivery layer for more aggressive Iranian operations — several intrusions that began as MuddyWater access ended in ransomware or hack-and-leak conducted by related clusters.",
    "attribution": {
      "sponsor": "Iran",
      "service": "MOIS — Ministry of Intelligence and Security",
      "confidence": "confirmed",
      "summary": "U.S. Cyber Command publicly identified MuddyWater as a subordinate element within Iran's Ministry of Intelligence and Security in January 2022, releasing malware samples to VirusTotal alongside the statement. The attribution was corroborated by a joint advisory from CISA, FBI, NSA, U.S. Cyber Command CNMF, and UK NCSC the following month.",
      "sources": [
        {
          "org": "U.S. Cyber Command",
          "title": "Iranian intel cyber suite of malware uses open source tools — MuddyWater identified as MOIS element",
          "url": "https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/",
          "date": "2022-01-12"
        },
        {
          "org": "CISA / FBI / NSA / CNMF / NCSC-UK",
          "title": "Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations (AA22-055A)",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a",
          "date": "2022-02-24"
        }
      ]
    },
    "motivations": [
      "espionage"
    ],
    "targetSectors": [
      "Government",
      "Telecommunications",
      "Energy",
      "Defense",
      "Oil & Gas",
      "Technology",
      "Education",
      "Financial Services",
      "Transportation",
      "Manufacturing"
    ],
    "targetCountries": [
      "Israel",
      "Saudi Arabia",
      "Türkiye",
      "United Arab Emirates",
      "Jordan",
      "Iraq",
      "Egypt",
      "United States",
      "India",
      "Pakistan",
      "Azerbaijan"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "MuddyWater",
        "url": "https://attack.mitre.org/groups/G0069/",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Mango Sandstorm",
        "correlation": "exact",
        "note": "Formerly MERCURY"
      },
      {
        "org": "microsoft",
        "name": "MERCURY",
        "correlation": "exact",
        "note": "Retired designator"
      },
      {
        "org": "crowdstrike",
        "name": "Static Kitten",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "TEMP.Zagros",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "COBALT ULSTER",
        "correlation": "exact"
      },
      {
        "org": "unit42",
        "name": "Boggy Serpens",
        "correlation": "exact"
      },
      {
        "org": "trendmicro",
        "name": "Earth Vetala",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "MuddyWater / MOIS",
        "correlation": "exact"
      },
      {
        "org": "kaspersky",
        "name": "Seedworm",
        "correlation": "exact",
        "note": "Also used by Symantec"
      },
      {
        "org": "symantec",
        "name": "Seedworm",
        "correlation": "exact"
      }
    ],
    "tools": [
      {
        "name": "Atera Agent",
        "type": "utility",
        "custom": false,
        "description": "Legitimate commercial RMM software installed as the primary access mechanism — signed, reputable, and invisible to antivirus."
      },
      {
        "name": "ScreenConnect / SimpleHelp",
        "type": "utility",
        "custom": false,
        "description": "Additional commercial remote-support tools used interchangeably as backup access channels."
      },
      {
        "name": "PowGoop",
        "type": "loader",
        "custom": true,
        "description": "DLL loader masquerading as a Google Update component, decrypting and running PowerShell stages."
      },
      {
        "name": "SmallSieve",
        "type": "backdoor",
        "custom": true,
        "description": "Python backdoor using the Telegram API for C2, released publicly by U.S. Cyber Command."
      },
      {
        "name": "MuddyC2Go",
        "type": "framework",
        "custom": true,
        "description": "Go-based command-and-control framework replacing earlier PowerShell-centric infrastructure."
      },
      {
        "name": "Ligolo",
        "type": "utility",
        "custom": false,
        "description": "Open-source reverse tunnelling tool used for pivoting into internal networks."
      },
      {
        "name": "chisel",
        "type": "utility",
        "custom": false,
        "description": "Open-source TCP/UDP tunnel over HTTP for traversing network boundaries."
      }
    ],
    "techniques": [
      {
        "tCode": "T1566.001",
        "name": "Phishing: Spearphishing Attachment",
        "tactic": "Initial Access",
        "note": "Sent from compromised legitimate mailboxes at real organisations"
      },
      {
        "tCode": "T1219",
        "name": "Remote Access Software",
        "tactic": "Command and Control",
        "note": "Signature technique — legitimate commercial RMM as the primary C2 channel"
      },
      {
        "tCode": "T1190",
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access",
        "note": "Exchange, Log4Shell, and Zoho ManageEngine"
      },
      {
        "tCode": "T1059.001",
        "name": "Command and Scripting Interpreter: PowerShell",
        "tactic": "Execution"
      },
      {
        "tCode": "T1218.011",
        "name": "System Binary Proxy Execution: Rundll32",
        "tactic": "Defense Evasion"
      },
      {
        "tCode": "T1105",
        "name": "Ingress Tool Transfer",
        "tactic": "Command and Control",
        "note": "OneDrive, Dropbox, and file-sharing services for staging"
      },
      {
        "tCode": "T1572",
        "name": "Protocol Tunneling",
        "tactic": "Command and Control",
        "note": "chisel and Ligolo for internal pivoting"
      },
      {
        "tCode": "T1003.001",
        "name": "OS Credential Dumping: LSASS Memory",
        "tactic": "Credential Access"
      },
      {
        "tCode": "T1112",
        "name": "Modify Registry",
        "tactic": "Defense Evasion"
      },
      {
        "tCode": "T1102",
        "name": "Web Service",
        "tactic": "Command and Control",
        "note": "Telegram API used by SmallSieve"
      },
      {
        "tCode": "T1053.005",
        "name": "Scheduled Task/Job: Scheduled Task",
        "tactic": "Persistence"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2020-0688",
        "firstExploited": "2020-05-01",
        "usage": "Exchange static validation key exploited for authenticated remote code execution as SYSTEM on mail servers.",
        "source": {
          "org": "CISA and partners",
          "title": "AA22-055A: Iranian Government-Sponsored MuddyWater Actors",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a",
          "date": "2022-02-24"
        }
      },
      {
        "cveId": "CVE-2020-1472",
        "firstExploited": "2020-10-01",
        "usage": "Zerologon used for rapid domain controller compromise after initial foothold.",
        "source": {
          "org": "CISA and partners",
          "title": "AA22-055A: Iranian Government-Sponsored MuddyWater Actors",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a",
          "date": "2022-02-24"
        }
      },
      {
        "cveId": "CVE-2021-44228",
        "firstExploited": "2022-01-01",
        "usage": "Log4Shell exploited against internet-facing Java applications, including SysAid servers at Israeli targets.",
        "source": {
          "org": "Microsoft Threat Intelligence",
          "title": "MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/",
          "date": "2022-08-25"
        }
      },
      {
        "cveId": "CVE-2022-47966",
        "firstExploited": "2023-01-01",
        "usage": "Zoho ManageEngine unauthenticated RCE exploited for initial access to enterprise networks.",
        "source": {
          "org": "Unit 42",
          "title": "Iranian threat actors exploiting ManageEngine vulnerabilities",
          "url": "https://unit42.paloaltonetworks.com/manageengine-cve-2022-47966/",
          "date": "2023-02-02"
        }
      },
      {
        "cveId": "CVE-2021-34473",
        "firstExploited": "2021-10-01",
        "usage": "ProxyShell chain exploited for Exchange access at regional government and telecom targets.",
        "source": {
          "org": "CISA and partners",
          "title": "AA22-055A: Iranian Government-Sponsored MuddyWater Actors",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a",
          "date": "2022-02-24"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "apt34",
        "type": "same-sponsor",
        "confidence": "high",
        "note": "Both MOIS-linked with overlapping regional targeting and occasional shared infrastructure."
      },
      {
        "relatedActorId": "apt35",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both Iranian state-nexus; different services with overlapping regional target sets."
      },
      {
        "relatedActorId": "pioneer-kitten",
        "type": "supplier",
        "confidence": "moderate",
        "note": "Iranian access operations have repeatedly handed footholds to other clusters for follow-on ransomware or hack-and-leak."
      }
    ],
    "reports": [
      {
        "org": "CISA and partners",
        "title": "AA22-055A: Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations",
        "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a",
        "date": "2022-02-24"
      },
      {
        "org": "U.S. Cyber Command",
        "title": "Iranian intel cyber suite of malware uses open source tools",
        "url": "https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/",
        "date": "2022-01-12"
      },
      {
        "org": "Deep Instinct",
        "title": "MuddyWater's Light First-Stage Framework: MuddyC2Go",
        "url": "https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel",
        "date": "2023-11-09"
      },
      {
        "org": "Symantec",
        "title": "Seedworm: Iran-Linked Group Continues to Target Organizations in the Middle East",
        "url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/iran-apt-seedworm-africa-telecoms",
        "date": "2023-11-15"
      }
    ],
    "campaigns": [
      {
        "id": "muddywater-israel",
        "actorId": "muddywater",
        "name": "Israeli Organisation Targeting",
        "date": "2023-10-01",
        "significance": "major",
        "targetSectors": [
          "Government",
          "Technology",
          "Telecommunications",
          "Education",
          "Defense"
        ],
        "targetCountries": [
          "Israel"
        ],
        "cveIds": [
          "CVE-2021-44228"
        ],
        "summary": "Sharply increased operations against Israeli government, technology, and academic organisations following October 2023, using compromised legitimate mailboxes for delivery and commercial remote monitoring software for access.",
        "sources": [
          {
            "org": "Deep Instinct",
            "title": "MuddyC2Go: Latest C2 framework used by MuddyWater spotted in Israel",
            "url": "https://www.deepinstinct.com/blog/muddyc2go-latest-c2-framework-used-by-iranian-apt-muddywater-spotted-in-israel",
            "date": "2023-11-09"
          }
        ]
      }
    ],
    "flag": "🇮🇷",
    "profile": "/apt/muddywater/"
  }
}