MuddyWater
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.
Attribution signal
?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 LowAttribution signals
20 mentions · 3 sources"a new cyber campaign attributed with high confidence to the Iranian threat actor known as MuddyWater"
"ESET has documented multiple campaigns attributed to MuddyWater"
"In March 2026, Ctrl-Alt-Intel published a report documenting active exploitation of CVE-2025-34291 by MuddyWater, an Iran-nexus APT group, which used the vulnerability to gain initial access to target networks."
"The campaign was orchestrated by the MuddyWater cyberespionage group"
"Researchers linked Iran's MuddyWater to using the Chaos ransomware as cover for espionage and data theft."
"MuddyWater remains very much active in 2026 – last month, security researchers at Broadcom's Symantec and Carbon Black identified the group in the networks of multiple US entities, including an airport, a bank, and a software firm with ties to Israel"
"APT group MuddyWater impersonates Chaos ransomware, conducts social engineering through Microsoft Teams and screen sharing"
"We observed a continued increase in spearphishing activities of the Iran-aligned MuddyWater."
"It is one of the most active Iran-aligned APT groups tracked by ESET researchers and has links to the Ministry of Intelligence and National Security of Iran"
"Researchers have published a threat assessment of MuddyWater, linking the Iranian APT group to spear-phishing and LampoRAT."
"These attacks follow similar patterns and align with the killchains previously observed in MuddyWater attacks"
"MuddyWater has worked closely with Lyceum, a subgroup of OilRig, as well as probably acted as an initial access broker (IAB) for other Iran-aligned groups"
Hedge terms observed