S0223: POWERSTATS
POWERSTATS is a PowerShell-based first stage backdoor used by MuddyWater. [1]
Security context for executives and security teams
S0223: POWERSTATS describes [POWERSTATS](https://attack.mitre.org/software/S0223) is a PowerShell-based first stage backdoor used by [MuddyWater](https://attack.mitre.org/groups/G0069). (Citation: Unit 42 MuddyWater Nov 2017)
Executive priority
S0223: POWERSTATS is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S0223: POWERSTATS by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S0223: POWERSTATS appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
POWERSTATS
POWERSTATS is a PowerShell-based first stage backdoor used by MuddyWater. [1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1559.001 | Component Object ModelSub-technique | POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | POWERSTATS can deobfuscate the main backdoor code.[2] |
| Enterprise | T1033 | System Owner/User Discovery | POWERSTATS has the ability to identify the username on the compromised host.CitationTrendMicro POWERSTATS V3 June 2019 |
| Enterprise | T1036.004 | Masquerade Task or ServiceSub-technique | POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.[2] |
| Enterprise | T1087.001 | Local AccountSub-technique | POWERSTATS can retrieve usernames from compromised hosts.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | POWERSTATS has detected security tools.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1218.005 | MshtaSub-technique | POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1047 | Windows Management Instrumentation | POWERSTATS can use WMI queries to retrieve data from compromised hosts.CitationFireEye MuddyWater Mar 2018[2] |
| Enterprise | T1029 | Scheduled Transfer | POWERSTATS can sleep for a given number of seconds.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1082 | System Information Discovery | POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.CitationFireEye MuddyWater Mar 2018CitationTrendMicro POWERSTATS V3 June 2019 |
| Enterprise | T1132.001 | Standard EncodingSub-technique | POWERSTATS encoded C2 traffic with base64.[1] |
| Enterprise | T1090.002 | External ProxySub-technique | POWERSTATS has connected to C2 servers through proxies.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1559.002 | Dynamic Data ExchangeSub-technique | POWERSTATS can use DDE to execute additional payloads on compromised hosts.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1059.001 | PowerShellSub-technique | POWERSTATS uses PowerShell for obfuscation and execution.[1][2]CitationTrendMicro POWERSTATS V3 June 2019CitationDHS CISA AA22-055A MuddyWater February 2022 |
| Enterprise | T1016 | System Network Configuration Discovery | POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.CitationFireEye MuddyWater Mar 2018CitationTrendMicro POWERSTATS V3 June 2019 |
| Enterprise | T1005 | Data from Local System | POWERSTATS can upload files from compromised hosts.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1685 | Disable or Modify Tools | POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | POWERSTATS has established persistence through a scheduled task using the command |
| Enterprise | T1573.002 | Asymmetric CryptographySub-technique | POWERSTATS has encrypted C2 traffic with RSA.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1027.010 | Command ObfuscationSub-technique | POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob. CitationFireEye MuddyWater Mar 2018[2] POWERSTATS has used PowerShell code with custom string obfuscation CitationTrendMicro POWERSTATS V3 June 2019 |
| Enterprise | T1070.004 | File DeletionSub-technique | POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1059.005 | Visual BasicSub-technique | POWERSTATS can use VBScript (VBE) code for execution.[2]CitationTrendMicro POWERSTATS V3 June 2019 |
| Enterprise | T1059.007 | JavaScriptSub-technique | POWERSTATS can use JavaScript code for execution.[2] |
| Enterprise | T1105 | Ingress Tool Transfer | POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.CitationFireEye MuddyWater Mar 2018 |
| Enterprise | T1113 | Screen Capture | POWERSTATS can retrieve screenshots from compromised hosts.CitationFireEye MuddyWater Mar 2018CitationTrendMicro POWERSTATS V3 June 2019 |
| Enterprise | T1027.016 | Junk Code InsertionSub-technique | POWERSTATS has used useless code blocks to counter analysis.CitationTrendMicro POWERSTATS V3 June 2019 |
| Enterprise | T1057 | Process Discovery | POWERSTATS has used |
Groups, software, and campaigns
G0069: MuddyWater
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 2.3 | Current bundle | 63ecb084bb4d… | ||
| 19.1 | 2.3 | Older bundle | 63ecb084bb4d… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Unit 42 MuddyWater Nov 2017
Lancaster, T.. (2017, November 14). Muddying the Water: Targeted Attacks in the Middle East. Retrieved March 15, 2018.
Open source URL - [2]ClearSky MuddyWater Nov 2018
ClearSky Cyber Security. (2018, November). MuddyWater Operations in Lebanon and Oman: Using an Israeli compromised domain for a two-stage campaign. Retrieved November 29, 2018.
Open source URL - [3]Symantec MuddyWater Dec 2018
Symantec DeepSight Adversary Intelligence Team. (2018, December 10). Seedworm: Group Compromises Government Agencies, Oil & Gas, NGOs, Telecoms, and IT Firms. Retrieved December 14, 2018.
Open source URL - [4]POWERSTATS
(Citation: Unit 42 MuddyWater Nov 2017)(Citation: ClearSky MuddyWater Nov 2018)
- [5]Powermud
(Citation: Symantec MuddyWater Dec 2018)
- [6]mitre-attackS0223Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.