group

MuddyWater G0069

Created: 18 April 2018
Last modified: 31 July 2026
Aliases: MuddyWater · Earth Vetala · MERCURY · Static Kitten · Seedworm · TEMP.Zagros · Mango Sandstorm · TA450 · MuddyKrill

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

TechniquesTop 6%

TacticsTop 6%

Tools & malwareTop 6%

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Teoderick Contreras, Splunk	2021-08-17	2026-05-13	01d29b48-ff6f-11eb-b81e-acde48001123
	Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-27	2026-06-05	ec570e53-4c76-45a9-804d-dc3f355ff7a7
Splunk	The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...)	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-10-09	fb4c31b0-13e8-4155-8aa5-24de4b8d6717
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
Splunk	The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2024-21887 CVE-2023-46805 CVE-2023-46085	medium	Michael Haag, Splunk	2024-01-17	2026-05-13	15838756-f425-43fa-9d88-a7f88063e81a
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
Splunk	The following analytic identifies potential lateral movement activities within an organization's Active Directory (AD) environment. (...)	Correlation	stable	-	-	-	Lateral Movement Exploitation of Remote Services	-	medium	Michael Haag, Splunk	2023-04-19	2026-05-13	6aa6f9dd-adfe-45a8-8f74-c4c7a0d7d037
	Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	—	e5d36acd-acb4-4c6f-a13f-9eb203d50099
	Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs	Generic	test	-	windows	WinEventLog Security	Discovery Account Discovery Domain Account	-	high	Samir Bousseaden	2019-04-03	2022-07-13	35ba1d85-724d-42a3-889f-2e2362bcaf23
Splunk	The following analytic detects the use of commands to add or set exclusions in Windows Defender. It (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2021-11-25	2026-06-08	773b66fe-4dd9-11ec-8289-acde48001122
	Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-02	2024-03-19	d7662ff6-9e97-4596-a61d-9839e32dee8d
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
Splunk	The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-29298 CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	d6821c0b-fcdc-4c95-a77f-e10752fae41a
Splunk	The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	695aceae-21db-4e7f-93ac-a52e39d02b93
	Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSel (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-40539	high	Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)	2021-09-20	2023-01-02	6702b13c-e421-44cc-ab33-42cc25570f11
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-10-02	de7fcadc-04f3-11ec-a241-acde48001122
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2022-10-20	1e53dd56-8d83-4eb4-a43e-b790a05510aa
	This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	—	078235c5-6ec5-48e7-94b2-f8b5474379ea
	Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2024-12-01	cd951fdc-4b2f-47f5-ba99-a33bf61e3770
	Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts	Generic	test	ps_script	windows	PowerShell	Defense Impairment Disable or Modify Tools	-	high	Florian Roth (Nextron Systems)	2022-11-09	—	e0d6c087-2d1c-47fd-8799-3904103c5a98
	Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-12-25	—	aa37cbb0-da36-42cb-a90f-fdf216fc7467
Splunk	The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Michael Haag, Teoderick Contreras, Splunk	2021-04-22	2026-05-13	9364ee8e-a39a-11eb-8f1d-acde48001122
	Detects a highly relevant Antivirus alert that reports APT malware. (...)	Generic	experimental	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Arnim Rupp (Nextron Systems)	2026-06-15	—	101a1877-2cf4-474d-abfd-7f6ac4788d1a
	Detects a highly relevant Antivirus alert that reports an exploitation framework. (...)	Generic	stable	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	238527ad-3c2c-4e4f-a1f6-92fd63adb864
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects a highly relevant Antivirus alert that reports a remote access tool. (...)	Generic	experimental	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Arnim Rupp (Nextron Systems)	2026-06-15	—	97233998-3838-4581-88c6-f1d19d3993fb
	Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	@kostastsale, Nasreddine Bencherchali (Nextron Systems)	2023-11-05	2024-08-16	31e124fb-5dc4-42a0-83b3-44a69c77b271
	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. (...)	Generic	test	file_event	windows	Sysmon	Command and Control Remote Access Tools Remote Desktop Software	-	medium	frack113	2022-02-11	2024-07-20	0b9ad457-2554-44c1-82c2-d56a99c42377
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective	Emerging	test	process_creation	linux	Sysmon	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-20	—	c8a5f584-cdc8-42cc-8cce-0398e4265de3
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-19	2023-01-02	1a9a04fd-02d1-465c-abad-d733fd409f9c
	Detects an issue in apache logs that reports threading related errors	Generic	test	-	-	Apache	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Florian Roth (Nextron Systems)	2019-01-22	2021-11-27	e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
	Detects the removal or uninstallation of an application via "Wmic.EXE".	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	frack113	2022-01-28	2024-07-02	b53317a0-8acf-4fd1-8de8-a5401e776b96
	Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-11	—	49d9671b-0a0a-4c09-8280-d215bfd30662
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	critical	Florian Roth (Nextron Systems)	2018-09-03	2023-03-09	9aa01d62-7667-4d3b-acb8-8cb5103e2014
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems), @41thexplorer	2018-11-20	2023-03-08	7453575c-a747-40b9-839b-125a0aae324b
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Rundll32	-	critical	@41thexplorer	2018-11-20	2023-02-20	3a3f81ca-652c-482b-adeb-b1c804727f74
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Execution User Execution	-	medium	Sreeman	2020-03-13	2022-04-14	24de4f3b-804c-4165-b442-5a06a2302c7e

Title

Description

MuddyWater G0069

MuddyWater G0069

MuddyWater MITRE reference G0069

MuddyWater MITRE reference G0069

Standing G0069

Reach

Coverage

MuddyWater detections G0069