TEMP.Zagros

TEMP.Zagros is Mandiant's designation for the Iranian MOIS-linked threat cluster known as MuddyWater. Mandiant documented TEMP.Zagros conducting spear phishing campaigns against government and telecommunications targets in the Middle East and Central Asia using PowerShell-based implants and macro-laden Office documents. The name reflects Mandiant's geographic naming convention referencing the Zagros Mountains of Iran. TEMP.Zagros activity aligns closely with Symantec's Seedworm and Microsoft's Mercury tracking of the same cluster.