Actors Insights|Latest update27/08/2026

Seedworm

Named by SymantecSuspected state sponsor: Islamic Republic of Iran

Seedworm is Symantec's designation for the Iranian MOIS-linked threat cluster known as MuddyWater. Active since at least 2017, Symantec documented the group's targeting of government, energy, and telecommunications organizations across the Middle East and Central Asia. Seedworm operations use spear phishing to deliver custom backdoors including POWERSTATS and Canopy, with Symantec noting the group's rapid operational tempo — often pivoting from initial compromise to active data collection within hours. The cluster shares infrastructure, tooling, and targeting patterns with MuddyWater tracking across other vendors.

First Seen:Sep 2018
Last Seen:May 2026
Indexed Reports:8
Public IOCs:143
Cluster: MuddyWaterMitre: MuddyWaterMisp: MuddyWater
also known as:
TEMP.Zagros (Mandiant)Static Kitten (CrowdStrike)Seedworm (Symantec)MERCURY (Microsoft)COBALT ULSTER (SecureWorks)G0069 (Mitre)ATK51 (Thales)Boggy SerpensMango Sandstorm (Microsoft)TA450 (Proofpoint)Earth Vetala (Trend Micro)MuddyWater (Palo Alto)

Targeted Regions

Afghanistan
AF
Afghanistan
Afghanistan
Sep 2018 ~ Dec 2018
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Armenia
AM
Armenia
Armenia
Sep 2018 ~ Dec 2018
Azerbaijan
AZ
Azerbaijan
Azerbaijan
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Cambodia
KH
Cambodia
Cambodia
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Canada
CA
Canada
Canada
Feb 2026 ~ Mar 2026
Egypt
EG
Egypt
Egypt
Sep 2018 ~ Dec 2018
Nov 2023 ~ Dec 2023
Nov 2023 ~ Dec 2023
Georgia
GE
Georgia
Georgia
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Iraq
IQ
Iraq
Iraq
Sep 2018 ~ Dec 2018
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Israel
IL
Israel
Israel
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Jordan
JO
Jordan
Jordan
Sep 2018 ~ Dec 2018
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Kuwait
KW
Kuwait
Kuwait
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Laos
LA
Laos
Laos
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Middle East
ME
Middle East
Middle East
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Feb 2026 ~ May 2026
Feb 2026 ~ May 2026
Netherlands
NL
Netherlands
Netherlands
Sep 2018 ~ Dec 2018
Oman
OM
Oman
Oman
Sep 2018 ~ Dec 2018
Pakistan
PK
Pakistan
Pakistan
Sep 2018 ~ Dec 2018
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Russia
RU
Russia
Russia
Sep 2018 ~ Dec 2018
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2018 ~ Dec 2018
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
South Korea
KR
South Korea
South Korea
Feb 2026 ~ May 2026
Feb 2026 ~ May 2026
Sudan
SD
Sudan
Sudan
Nov 2023 ~ Dec 2023
Nov 2023 ~ Dec 2023
Tanzania
TZ
Tanzania
Tanzania
Nov 2023 ~ Dec 2023
Nov 2023 ~ Dec 2023
Thailand
TH
Thailand
Thailand
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Turkey
TR
Turkey
Turkey
Sep 2018 ~ Dec 2018
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
United States
US
United States
United States
Sep 2018 ~ Dec 2018
Feb 2026 ~ Mar 2026
Vietnam
VN
Vietnam
Vietnam
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Sep 2018Aug 2026

Targeted Sectors

TelecommunicationGovernment Agencies and ServicesInformation TechnologyManufacturingAerospaceEducationOil and GasFinancialProfessional ServiceTransportationBankingCivicUtilitiesHealthcareReal Estate

Recent Indexed Reports

  1. Public
    Iran-Linked Seedworm Escalates Global Espionage with Enhanced Node.js Tradecraft
  2. Public
    Iranian APT Seedworm Targets U.S., Israel, and Canada with Novel Backdoors
  3. Public
    Seedworm Leverages Atera Agent in Sophisticated Spear-Phishing Scheme
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.