Loading story…
A joint U.S.-U.K. advisory warned that the Iran-linked APT group MuddyWater, tied to Iran’s Ministry of Intelligence and Security, is targeting government and private-sector organizations across Asia, Africa, Europe, and North America. The campaign has hit sectors including telecommunications, defense, local government, and oil and natural gas, with operators using spear-phishing, exploitation of known Microsoft flaws such as CVE-2020-1472 and CVE-2020-0688, open-source tooling, and a broad malware arsenal including PowGoop, Small Sieve, Canopy/Starwhale, Mori, and POWERSTATS for delivery, persistence, command and control, and data theft.
The warning aligns with years of reporting that MuddyWater has run espionage operations using macro-laced lure documents, staged PowerShell payloads, LOLBins such as rundll32.exe and mshta.exe, scheduled tasks, and compromised domains to infect targets in the Middle East and beyond, including Lebanon and Oman. Researchers have also linked the group to more disruptive activity, including the DarkBit ransomware campaign, indicating that MuddyWater’s operations now span both intelligence collection and destructive or coercive attacks; agencies urged organizations to strengthen cyber hygiene, patch exposed systems, and apply tighter application controls to reduce risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
K7 Labs analyzed a DarkBit ransomware campaign attributed to MuddyWater, describing an infection chain using an ISO lure, a disguised shortcut, PrintBrm.exe, and a Cobalt Strike beacon before deployment of the ransomware payload.
ClearSky reported a MuddyWater espionage campaign targeting likely victims in Lebanon and Oman across government, academia, cryptocurrency, telecommunications, and oil, using macro-laced lures and a two-stage infection chain that deployed POWERSTATS.
Researchers observed a large volume of MuddyWater spear-phishing documents throughout 2018, with activity escalating from May onward, targeting government, military, telecommunications, and educational entities across the Middle East and beyond.
A joint U.S.-U.K. advisory said MuddyWater has conducted broad cyber campaigns in support of Iran's Ministry of Intelligence and Security objectives since 2018.
Kaspersky observed MuddyWater in 2017 using spear-phishing against government agencies, military institutions, telecommunications companies, and universities in the Middle East.
A joint advisory from U.K. and U.S. agencies warned that MuddyWater was targeting government and private-sector organizations across Asia, Africa, Europe, and North America, including telecommunications, defense, local government, and oil and natural gas.
Government agencies observed MuddyWater exploiting the Microsoft Netlogon vulnerability CVE-2020-1472 and Microsoft Exchange vulnerability CVE-2020-0688 to access sensitive government and commercial networks.
Microsoft published a Security Update Guide entry for CVE-2020-0688, a Microsoft Exchange vulnerability later cited as exploited by MuddyWater.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
inforisktoday.com
Open sourcesecurelist.com
Open sourcelabs.k7computing.com
Open sourcecisa.gov
Open sourceclearskysec.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iranian state-linked threat group **MuddyWater** targeted governments, ministries, universities, telecommunications providers, and other organizations in Turkey, the Arabian Peninsula, Pakistan, Armenia, and nearby countries with evolving espionage malware campaigns. Researchers said the group delivered malicious Excel and Office documents through phishing, using macros and the Office exploit `CVE-2017-0199` to launch multi-stage infections that dropped Windows Script Files, persistence components, and remote access tools including **SloughRAT**—also tracked as **Canopy**—along with additional Visual Basic and JavaScript implants. The intrusion chains used compromised or attacker-controlled infrastructure, regional decoy themes tied to Tajikistan, Pakistan, and Kurdistan, and fallback behavior that sometimes redirected victims to benign sites when command-and-control failed. Cisco Talos and Clearsky reported that MuddyWater combined PowerShell, living-off-the-land binaries, DNS and HTTP command-and-control, token-tracking mechanisms, and staged payload retrieval to execute arbitrary commands on victim systems, underscoring a broader shift toward more flexible and advanced tradecraft aligned with Iranian intelligence objectives.
Aug 14, 2026
Iran-linked threat group **MuddyWater** has been tied to a **ChainShell** campaign that reportedly uses Russian malware-as-a-service infrastructure, underscoring growing overlap between state-backed espionage and criminal tooling. Reporting on the activity said the operation relied on **blockchain-based command-and-control** and reflected operational links between the Iran-aligned actor and Russian cybercrime services, extending a long-running pattern of MuddyWater adapting external tools and tradecraft for intrusion operations. U.S. and allied agencies have previously attributed MuddyWater to Iran’s **Ministry of Intelligence and Security (MOIS)** and described the group as targeting government and commercial organizations across Asia, Africa, Europe, and North America, including telecommunications, defense, local government, and oil and gas. Public reporting and government advisories say the group has used spearphishing, exploitation of known flaws such as `CVE-2020-0688` and `CVE-2020-1472`, **DLL side-loading**, obfuscated PowerShell, and malware including **PowGoop**, **Mori**, **Small Sieve**, **Canopy/Starwhale**, and **POWERSTATS** to establish access, maintain persistence, exfiltrate data, and in some cases deploy ransomware.
Jun 29, 2026
Iranian state-sponsored threat actor MuddyWater has conducted a large-scale cyberespionage campaign breaching over 100 government entities and international organizations across the Middle East and North Africa. The attackers leveraged a compromised enterprise mailbox, accessed via NordVPN, to send convincing phishing emails from legitimate addresses to embassies, ministries, and telecom providers. These emails contained weaponized Microsoft Word attachments that, when opened and macros enabled, deployed the updated "Phoenix" backdoor, granting persistent remote access, credential theft, and file exfiltration capabilities. The campaign also utilized off-the-shelf remote management tools such as PDQ and Action1 to blend in with legitimate administrative traffic and pilfered browser passwords from Chrome, Edge, Opera, and Brave. Researchers at Group-IB highlighted that MuddyWater, also known as Seedworm, APT34, OilRig, and TA450, has demonstrated evolving tradecraft and operational maturity in this operation, mixing official government and personal email addresses to increase the likelihood of successful compromise. The campaign's scale and targeting suggest either a significant increase in capability or a broader intelligence collection mandate from Iranian authorities. MuddyWater, linked to Iran's Ministry of Intelligence and Security, has a history of targeting government, energy, telecom, and defense sectors, focusing on long-term espionage rather than destructive attacks. Analysts warn that further activity is likely amid ongoing regional tensions.
Jun 29, 2026