TA450

TA450 is Proofpoint's designation for the Iranian MOIS-linked threat cluster known as MuddyWater. Active since at least 2024 in Proofpoint's tracking, TA450 conducts spear phishing campaigns using PDF attachments with embedded links targeting Israeli organizations, as well as government and finance sector targets in the Middle East. Proofpoint documented the group's use of legitimate remote management tools alongside phishing campaigns — consistent with MuddyWater's established tradecraft — and noted a campaign focus on Israeli targets coinciding with geopolitical tensions following October 2023.