Loading threat actor…
MuddyCoast, also tracked as UNC3313, is an Iran-nexus cyber espionage threat actor associated with surveillance and strategic information-gathering operations. The group has been linked to spear-phishing campaigns and malware delivery operations aligned with broader Iranian targeting patterns in the Middle East, and has been described as affiliated with MuddyWater. UNC3313 has used custom backdoors and droppers including STARWHALE, STARWHALE.GO, GRAMDOOR, JELLYBEAN, CANDYBOX, and CACTUSPAL. Observed tradecraft includes phishing-based initial access, use of file-sharing services for payload delivery, deployment of NSIS-based installers, persistence through Windows services, Run-key persistence, scheduled-task-supported PowerShell downloaders, and use of legitimate remote monitoring and management tools to maintain access while reducing detection. The actor has also installed legitimate remote access software to establish persistent remote control. Its malware supports host enumeration, command execution, and return of execution results to command-and-control infrastructure. Variants attributed to the group have used custom encoding and obfuscation routines, HTTP-based command-and-control, and in one case the Telegram Bot API for command exchange. The actor has demonstrated defense-evasion behavior through string and traffic obfuscation, blending with legitimate tools and services, and use of cloud or enterprise-like infrastructure patterns seen more broadly in Iranian operations. MuddyCoast has also been observed using generative AI tooling to assist malware development and debugging. The group’s activity is consistent with espionage-driven collection rather than financially motivated operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Used Gemini to support malware development and debugging; operational security mistakes reportedly exposed C2 domains and keys.
UNC3313 is an Iranian threat group conducting surveillance and information-gathering via spear-phishing, using droppers, backdoors, and legitimate RMM tools.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.