Static Kitten

Static Kitten is Anomali's designation for the Iranian MOIS-linked threat cluster known as MuddyWater. Anomali documented Static Kitten conducting cyberespionage campaigns targeting UAE and Kuwait government agencies using legitimate remote desktop tools — particularly ScreenConnect — as part of its post-compromise toolkit. This characterization of the group's abuse of legitimate IT tools is consistent with broader MuddyWater tradecraft documented across other vendors, highlighting the cluster's preference for blending into normal enterprise IT management traffic to evade detection.