MuddyWater
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.
Attribution signal
?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 LowAttribution signals
21 mentions · 3 sources"a new cyber campaign attributed with high confidence to the Iranian threat actor known as MuddyWater"
"ESET has documented multiple campaigns attributed to MuddyWater"
"We observed a continued increase in spearphishing activities of the Iran-aligned MuddyWater."
"APT group MuddyWater impersonates Chaos ransomware, conducts social engineering through Microsoft Teams and screen sharing"
"The campaign was orchestrated by the MuddyWater cyberespionage group"
"Researchers linked Iran's MuddyWater to using the Chaos ransomware as cover for espionage and data theft."
"MuddyWater remains very much active in 2026 – last month, security researchers at Broadcom's Symantec and Carbon Black identified the group in the networks of multiple US entities, including an airport, a bank, and a software firm with ties to Israel"
"MuddyWater, Agrius, and Nimbus Manticore used this infrastructure for attacks that enabled remote access, credential theft, and scanning"
"In March 2026, Ctrl-Alt-Intel published a report documenting active exploitation of CVE-2025-34291 by MuddyWater, an Iran-nexus APT group, which used the vulnerability to gain initial access to target networks."
"Infrastructure overlap linking the campaign to historical MuddyWater operations dating back to October 2025"
"MuddyWater has worked closely with Lyceum, a subgroup of OilRig, as well as probably acted as an initial access broker (IAB) for other Iran-aligned groups"
"Researchers have published a threat assessment of MuddyWater, linking the Iranian APT group to spear-phishing and LampoRAT."
Hedge terms observed