Loading threat actor…
STAC 1171 is an activity cluster assessed with moderate confidence to be related to the Iranian threat actor MuddyWater, also known as TA450. MuddyWater is a state-aligned espionage actor associated with Iran and is known for phishing-led intrusions, abuse of legitimate administrative and remote management tooling, and hands-on-keyboard post-compromise activity. In the observed STAC 1171 activity, operators used phishing to gain initial access and lured victims into installing legitimate remote monitoring and management software, specifically Atera, to establish remote access. After access was established, the actor used remote execution to launch PowerShell, attempted credential dumping, created a backup of the SYSTEM hive, conducted domain enumeration, established tunneling for follow-on access, and attempted to deploy an additional remote management tool. This tradecraft is consistent with MuddyWater’s longstanding preference for blending malicious actions with legitimate tools and living-off-the-land techniques to reduce detection. Observed targeting in this cluster included organizations in Israel and the United States. The operational objective evidenced in the reporting is credential access and post-compromise network discovery, aligning more closely with espionage-oriented intrusion activity than financially motivated crime. Known aliases supported here include TA450, with STAC 1171 representing a tracked activity cluster linked to that broader actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
3 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting targeted phishing campaigns to trick victims into installing legitimate RMM tools such as Atera, then using remote commands and PowerShell to dump credentials, save the SYSTEM registry hive, enumerate domains, establish an SSH tunnel, and download Level RMM.
Conducting targeted phishing campaigns to trick victims into downloading legitimate RMM tools such as Atera, then using remote execution and PowerShell to dump credentials, save the SYSTEM registry hive, enumerate domains, establish an SSH tunnel, and download Level RMM.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.