muddywater-mango-sandstorm

• SKILL.mdcore · 34,508 bytes
• SKILL.mdcore · 34,508 bytes

# MuddyWater (Mercury, Mango Sandstorm, Static Kitten, Seedworm, TEMP.Zagros) — Adversary Emulation Profile

MuddyWater (MITRE ATT&CK **G0069**) is a cyber-espionage group assessed to be a subordinate element within Iran's **Ministry of Intelligence and Security (MOIS)**, active since at least 2017. The group has targeted government, telecommunications, defense, oil & gas, and IT organizations across the Middle East, Central/South Asia, Africa, Europe, and North America. MuddyWater is characterized by heavy reliance on **PowerShell-based backdoors** (POWERSTATS and its successors), **evolving custom C2 frameworks** (PhonyC2 → MuddyC2Go), **abuse of legitimate Remote Monitoring and Management (RMM) tools** (Atera, ScreenConnect, SimpleHelp), **spearphishing with macro-laden documents**, and a pragmatic blend of custom and open-source post-exploitation tooling. A February 2022 joint U.S./UK advisory (CISA AA22-055A) formally attributed the group to MOIS.

## Attribution & motivation

- **Sponsor / nation:** Islamic Republic of Iran — Ministry of Intelligence and Security (MOIS). U.S. Cyber Command's Cyber National Mission Force (CNMF) publicly linked MuddyWater to MOIS in January 2022; the February 2022 joint FBI/CISA/CNMF/NCSC-UK advisory **AA22-055A** formalized the attribution.
- **Motivation:** Primarily **strategic intelligence collection (espionage)** supporting Iranian state interests — political, military, and economic intelligence on regional rivals. Secondary motivations include **pre-positioning for disruptive operations** (the 2023 Technion "DarkBit" ransomware incident) and **access brokerage** (sharing/selling network access to other MOIS-aligned threat actors).
- **Attribution confidence:** **High.** Backed by U.S. government advisories (CISA AA22-055A), UK NCSC malware analysis reports, Israel National Cyber Directorate attributions, and consistent named vendor reporting (Microsoft, ESET, Deep Instinct, Cisco Talos, Symantec, ClearSky, Trend Micro, Proofpoint, Group-IB).

## Targeting

- **Sectors:** Government and public administration; telecommunications; defense and military; oil, gas, and energy; finance and insurance; IT and managed service providers; academia and research; airlines and logistics; healthcare and pharmaceuticals.
- **Regions:** Primary focus on the **Middle East** (Israel, Saudi Arabia, UAE, Kuwait, Oman, Egypt, Turkey, Iraq, Jordan, Lebanon); **Central and South Asia** (Pakistan, India, Malaysia); **Africa** (Algeria, North/East Africa); expanding into **Europe** and **North America** (since 2023–2025, targeting U.S. airports, banks, software companies).