G0069: MuddyWater

MuddyWater has sent targeted spearphishing e-mails with malicious links.[14][15][16]

MuddyWater has used a Word Template, Normal.dotm, for persistence.[8]

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.[9]

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.[14]Citationgroup-ib_muddywater_infra[12][11]

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.[17]CitationSecurelist MuddyWater Oct 2018

MuddyWater has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code.[11]

MuddyWater has used malware that leveraged WMI for execution and querying host information.CitationSecurelist MuddyWater Oct 2018[6]CitationTalos MuddyWater May 2019[9]

MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails.[2]

MuddyWater has performed credential dumping with LaZagne.[4][5]

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.[4][17]CitationSecurelist MuddyWater Oct 2018[7][14][15][9][16][12]CitationSOCRadar_MuddyWaterDindoor_Mar2026 MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.CitationCloudSEK_RustyWater_Jan2026

MuddyWater has established domains, some of which appeared to spoof legitimate domains for use in operations.[11]

MuddyWater has mapped target networks; access to this information and more is then shared/sold to other Iran threat actors.CitationFalconFeeds_MuddyWaterPSRust_Mar2026

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.CitationSecurelist MuddyWater Oct 2018[7][9]

MuddyWater has used ports 8043 and 8848 for botnet C2 communication.CitationFalconFeeds_MuddyWaterPSRust_Mar2026

MuddyWater has used a custom tool for creating reverse shells.[5]

MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals.[3]

MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.[17]

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.[17]CitationTalos MuddyWater May 2019[14]

MuddyWater has used cmd.exe net user /domain to enumerate domain users.[15]

MuddyWater has used JavaScript files to execute its POWERSTATS payload.[6][17][9]

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.[14][15][16][12]

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.[17]CitationMuddyWater TrendMicro June 2018CitationSecurelist MuddyWater Oct 2018[5][6][7][8][15][10]

MuddyWater has used malware to collect the victim’s IP address and domain name.CitationSecurelist MuddyWater Oct 2018

MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.[17]CitationSecurelist MuddyWater Oct 2018CitationTalos MuddyWater May 2019[8][15][10]

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.[17]CitationMuddyWater TrendMicro June 2018[6][10]

MuddyWater has used malware that can execute PowerShell scripts via DDE.CitationSecurelist MuddyWater Oct 2018

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.[4]CitationGitHub Invoke-Obfuscation The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.[4][17]CitationSecurelist MuddyWater Oct 2018CitationTalos MuddyWater May 2019[7][15][10]

MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.[6]

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.CitationSecurelist MuddyWater Oct 2018

MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.[10]

MuddyWater has used malware that can capture screenshots of the victim’s machine.CitationSecurelist MuddyWater Oct 2018

MuddyWater has used HTTP for C2 communications.[7][15]

MuddyWater can disable the system's local proxy settings.[15]

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.[15]

MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."CitationSecurelist MuddyWater Oct 2018

MuddyWater uses various techniques to bypass UAC.[6][11]

MuddyWater has used malware that can upload additional files to the victim’s machine.CitationSecurelist MuddyWater Oct 2018[6][8][15] MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data.[11]

MuddyWater has used AES to encrypt C2 responses.[10]

MuddyWater has attempted to exfiltrate data to Wasabi, a cloud storage service, using Rclone.CitationSOCRadar_MuddyWaterDindoor_Mar2026

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.[5][15]

MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com.[11]

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.[5]

MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft.[11] MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.CitationCloudSEK_RustyWater_Jan2026

MuddyWater has developed tools in Python including Out1.[15]

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.[15]

MuddyWater has used malware that can collect the victim’s OS version and machine name.CitationSecurelist MuddyWater Oct 2018CitationTalos MuddyWater May 2019[8][15][10]

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.[4][5][15]

MuddyWater has used malware to obtain a list of running processes on the system.CitationSecurelist MuddyWater Oct 2018[7]

MuddyWater has used tools to encode C2 communications including Base64 encoding.[7][15]

MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.CitationTalos MuddyWater May 2019

MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France.[2]

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.[14][15][16]

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.[6]

MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.[4][5][15]

MuddyWater has used scheduled tasks to establish persistence.[8]

MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location.[5] MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).[8][15] MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT), to communicate with a hardcoded C2 server, and to exfiltrate data.[12]

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.[4][17]CitationSecurelist MuddyWater Oct 2018CitationTalos MuddyWater May 2019[7][8][14][15][9][10][16] Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.CitationCloudSEK_RustyWater_Jan2026

MuddyWater has used malware that can collect the victim’s username.CitationSecurelist MuddyWater Oct 2018[15]

MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration.[15][14][16]Citationgroup-ib_muddywater_infra[2][11]CitationFalconFeeds_MuddyWaterPSRust_Mar2026

MuddyWater has used C2 infrastructure to receive exfiltrated data.[8]