MuddyWater
MuddyWater is an Iran-attributed nation-state APT group with an ideological motive, tracked by Brandefense. It targets 15 sectors, including Government and Technology, in 54 countries, including the United States and India. It uses 188 MITRE ATT&CK techniques and exploits 27 known CVEs.
- Origin
- Iran
- Techniques
- 188
- Exploited CVEs
- 27
- First seen
- Mar 25, 2024
- Last seen
- Jul 28, 2025
- Record updated
Who They Target.
About MuddyWater.
MuddyWater is an APT group that has been active throughout 2017, targeting victims in Middle East with in-memory vectors leveraging on Powershell, in a family of attacks now identified as “Living off the land”, as they don’t require the creation of new binaries on the victim’s machine, thus maintaining a low detection profile and a low forensic footprint. The operators behind MuddyWater are likely espionage motivated, we derive this information from the analysis of data and backdoors behaviors. We also find that despite the strong preponderance of victims from Pakistan, the most active targets appear to be in: Saudi Arabia, UAE and Iraq. Amongst the victims we identify a variety of entities with a stronger focus at Governments, Telcos and Oil companies. By tracking the operations we finally figure out that the originating country is likely to be Iran, while it remains harder to ascertain whether MuddyWater is state sponsored or a criminal organization incline to espionage. Sponsor: State-sponsored, IRGC (Islamic Republic Guard Corps).
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.