Actors Insights|Latest update04/07/2026

Boggy Serpens

Named by Palo AltoSuspected state sponsor: Islamic Republic of Iran

Boggy Serpens is Palo Alto Networks Unit 42's designation for the Iranian MOIS-linked cluster widely tracked as MuddyWater, active since at least 2017. The group targets diplomatic missions and critical infrastructure across the Middle East, Central Asia, and Europe, including energy, maritime, telecommunications, and financial organizations. Boggy Serpens hijacks legitimate government and corporate email accounts to bypass reputation-based spam filters, as seen in August 2025 when it used a compromised Omani Ministry of Foreign Affairs inbox to send malicious seminar invitations to foreign embassies. Its malware toolkit has evolved to include Rust-based tools like the BlackBeard backdoor showing evidence of AI-assisted development, with command and control channeled through the Telegram Bot API and custom UDP protocols. Operations from 2025 and early 2026 show sustained multi-wave campaigns against a single maritime and energy organization, demonstrating a targeted mandate from Iran's state intelligence apparatus.

First Seen:Aug 2025
Last Seen:Mar 2026
Indexed Reports:1
Public IOCs:48
Cluster: UnclassifiedMisp: MuddyWater
also known as:
TEMP.Zagros (Mandiant)Static Kitten (CrowdStrike)Seedworm (Symantec)MERCURY (Microsoft)COBALT ULSTER (SecureWorks)G0069 (Mitre)ATK51 (Thales)Boggy SerpensMango Sandstorm (Microsoft)TA450 (Proofpoint)Earth Vetala (Trend Micro)MuddyWater (Palo Alto)

Targeted Regions

Azerbaijan
AZ
Azerbaijan
Azerbaijan
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Egypt
EG
Egypt
Egypt
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Europe
EU
Europe
Europe
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Hungary
HU
Hungary
Hungary
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Israel
IL
Israel
Israel
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Middle East
ME
Middle East
Middle East
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Turkey
TR
Turkey
Turkey
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Turkmenistan
TM
Turkmenistan
Turkmenistan
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Aug 2025 ~ Mar 2026
Jan 2025Dec 2026

Targeted Sectors

FinancialGovernment Agencies and ServicesInformation TechnologyLogisticsMilitaryAerospaceEnergyPoliticalResearchersTelecommunication

Recent Indexed Reports

  1. Public
    Boggy Serpens Evolves Tactics: Hijacked Accounts and AI-Enhanced Malware Targeting Critical Infrastructure

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.