LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1037: STARWHALE

STARWHALE is Windows Script File (WSF) backdoor that has been used by MuddyWater, possibly since at least November 2021; there is also a STARWHALE variant written in Golang with similar capabilities. Security researchers have also noted the use of STARWHALE by UNC3313, which may be associated with MuddyWater.[1][2]

EnterpriseS1037MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

STARWHALE matters because it is a Windows backdoor, described as a Windows Script File with a Golang variant, that ATT&CK links to discovery, persistence, command execution, collection, staging, command-and-control, and exfiltration behaviors. For leaders, the practical issue is not the malware name alone; it is whether Windows endpoint, script, service, registry, and web-traffic telemetry can prove what happened if a user-opened malicious file leads to backdoor activity.

Executive priority

Prioritize STARWHALE as a readiness test for Windows endpoint visibility, user-executed malicious file handling, persistence control, and outbound web-channel monitoring. Because ATT&CK associates it with MuddyWater and references government and commercial targeting in the cited reporting, organizations in regulated or operationally sensitive sectors should ensure incident response can quickly answer: which host executed the file, what commands ran, what data was staged, and whether data left over C2-like web traffic.

Technical view

ATT&CK provides no official detection text, so SOC and IR validation should be relationship-driven. On Windows systems, validate coverage for WSF/VB and cmd execution, suspicious parent-child process chains from user-opened files, creation or modification of Windows services, Registry Run key or Startup Folder persistence, local discovery commands, local data staging, encoded or encrypted artifacts, and outbound web-protocol communications that may carry encoded data. Detection engineering should map STARWHALE coverage to the related techniques: T1204.002, T1059.003, T1059.005, T1543.003, T1547.001, T1033, T1016, T1082, T1005, T1074.001, T1071.001, T1132.001, T1027.013, and T1041.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Script execution telemetry for Windows Script File, Visual Basic, and related interpreters
  • File creation/modification events for suspicious scripts, encoded files, and local staging locations
  • Windows Registry monitoring for Run keys and Startup Folder persistence
  • Windows service creation and modification events

Detection direction

  • Confirm that user-opened malicious file execution is correlated with subsequent script, cmd, discovery, persistence, and network activity rather than treated as isolated alerts.
  • Tune for suspicious WSF/VB/cmd execution chains, especially when followed by system, user, or network discovery and outbound web traffic.
  • Monitor Windows service creation/modification and Registry Run key or Startup Folder changes, with allowlisting for legitimate software deployment and administration tools to reduce false positives.
  • Look for encoded or encrypted file content and standard encoding in network traffic, but avoid relying on encoding alone because legitimate applications also encode data.
  • Validate visibility into local data staging before exfiltration; many programs create temporary files, so prioritize staging combined with discovery, unusual process lineage, or outbound C2-like web traffic.

Mitigation priorities

  • Harden Windows endpoints against unnecessary script execution and restrict risky file types where business processes allow.
  • Apply least privilege so user-executed files have limited ability to create services, modify persistence locations, or access sensitive local data.
  • Monitor and control Windows service changes, Registry Run keys, and Startup Folder entries as high-value persistence surfaces.
  • Strengthen email, download, and user-execution controls for malicious file scenarios, while maintaining response playbooks for when a user opens a file.
  • Ensure outbound web traffic inspection, logging, and egress controls are sufficient to investigate command-and-control and exfiltration-over-C2-channel behavior.
Additional notes and limits

The object is a malware entry for STARWHALE in ATT&CK Enterprise, platform Windows, with no official detection guidance and no tactics listed on the malware object itself. The defensive interpretation is therefore derived from the official description, external references, and ATT&CK relationships showing techniques the malware uses. The relationship to MuddyWater and references to UNC3313 should guide intelligence context and prioritization, but local evidence is required for any incident attribution.

ATT&CK does not provide indicators, detection analytics, specific commands, C2 infrastructure, hashes, or confirmed local exposure in the supplied fields. Related technique platform lists include non-Windows platforms, but STARWHALE itself is supplied as Windows; coverage statements should be validated against the organization’s Windows environment and actual telemetry.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

STARWHALE

STARWHALE is Windows Script File (WSF) backdoor that has been used by MuddyWater, possibly since at least November 2021; there is also a STARWHALE variant written in Golang with similar capabilities. Security researchers have also noted the use of STARWHALE by UNC3313, which may be associated with MuddyWater.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

14 rows
DomainIDNameRelationship / procedure
EnterpriseT1082System Information Discovery

STARWHALE can gather the computer name of an infected host.[1][2]

EnterpriseT1543.003Windows ServiceSub-technique

STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: `sc create Windowscarpstss binpath= "cmd.exe /c cscript.exe c:\\windows\\system32\\w7_1.wsf humpback_whale" start= "auto" obj= "LocalSystem"`.[1]

EnterpriseT1041Exfiltration Over C2 Channel

STARWHALE can exfiltrate collected data to its C2 servers.[2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

STARWHALE can establish persistence by installing itself in the startup folder, whereas the GO variant has created a `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OutlookM` registry key.[2][1]

EnterpriseT1071.001Web ProtocolsSub-technique

STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.[1][2]

EnterpriseT1033System Owner/User Discovery

STARWHALE can gather the username from an infected host.[1][2]

EnterpriseT1204.002Malicious FileSub-technique

STARWHALE has relied on victims opening a malicious Excel file for execution.[2]

EnterpriseT1059.005Visual BasicSub-technique

STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.[1]

EnterpriseT1016System Network Configuration Discovery

STARWHALE has the ability to collect the IP address of an infected host.[2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

STARWHALE has been obfuscated with hex-encoded strings.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

STARWHALE has the ability to execute commands via `cmd.exe`.[1]

EnterpriseT1132.001Standard EncodingSub-technique

STARWHALE has the ability to hex-encode collected data from an infected host.[2]

EnterpriseT1005Data from Local System

STARWHALE can collect data from an infected local host.[2]

EnterpriseT1074.001Local Data StagingSub-technique

STARWHALE has stored collected data in a file called `stari.txt`.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1082: System Information DiscoveryEnterpriseuses · GroupG0069: MuddyWaterEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
8727708bf2721390...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle8727708bf272…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  2. [2]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  3. [3]
    CANOPY

    (Citation: DHS CISA AA22-055A MuddyWater February 2022)

  4. [4]
    CANOPY

    (Citation: DHS CISA AA22-055A MuddyWater February 2022)

  5. [5]
    CANOPY

    (Citation: DHS CISA AA22-055A MuddyWater February 2022)

  6. [6]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  7. [7]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  8. [8]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  9. [9]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  10. [10]
    mitre-attackS1037
    Open source URL
  11. [11]
    mitre-attackS1037
    Open source URL
  12. [12]
    mitre-attackS1037
    Open source URL
  13. [13]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  14. [14]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  15. [15]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  16. [16]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  17. [17]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  18. [18]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  19. [19]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  20. [20]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  21. [21]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  22. [22]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  23. [23]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  24. [24]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  25. [25]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  26. [26]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  27. [27]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  28. [28]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  29. [29]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  30. [30]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  31. [31]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  32. [32]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  33. [33]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  34. [34]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  35. [35]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  36. [36]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  37. [37]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  38. [38]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  39. [39]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  40. [40]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  41. [41]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  42. [42]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  43. [43]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  44. [44]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
  45. [45]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  46. [46]
    DHS CISA AA22-055A MuddyWater February 2022

    FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.

    Open source URL
  47. [47]
    Mandiant UNC3313 Feb 2022

    Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use