Cobalt Ulster

Cobalt Ulster is Secureworks' designation for the Iranian MOIS-linked threat cluster known as MuddyWater. Secureworks documented Cobalt Ulster operations targeting government and telecommunications organizations in the Middle East using PowerShell-based implants and spear phishing lures. The group's consistent MOIS attribution and targeting profile — focused on regional government intelligence collection — aligns precisely with the broader MuddyWater/Seedworm/Mango Sandstorm cluster tracking across the industry.