UNC3313

UNC3313 is Mandiant's unclassified threat cluster designation for a group assessed to be linked to MuddyWater, documented conducting espionage operations in late 2021. Mandiant tracked UNC3313 targeting government and private sector organizations in the Middle East using spear phishing and ScreenConnect remote access tool deployment — consistent with MuddyWater's known preference for legitimate remote administration tools. The UNC designation indicates Mandiant had not yet formally merged the activity into the TEMP.Zagros/MuddyWater cluster at time of reporting, though the technical and targeting overlaps are substantial.