Actors Insights|Latest update04/12/2023

MuddyWater Cluster

Suspected state sponsor: Islamic Republic of Iran

The MuddyWater Cluster is a well-known Iranian state-backed advanced persistent threat that is active in cyber industrial espionage. They usually target government and private entities across sectors such as telecommunications, defence, energy (oil and gas), and local administrations in the Middle East, Africa, and North America. This hacking group is part of the cyber operations of the Islamic Republic of Iran’s Ministry of Intelligence (MOIS) and provides stolen data and access to Iran’s regime. 

 

MuddyWater threat actors often combine spear phishing with the exploitation of publicly known vulnerabilities and open-source tools to gain access to their targets' infrastructure. The open-source tools used by MuddyWater are popular among cyber-criminal groups. As a result, MuddyWater was initially thought to be a cybercriminal group rather than a state-backed hacking group.

Most Common Tactics

Targeted Regions

Afghanistan
AF
Afghanistan
Afghanistan
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
Feb 2019 ~ Jun 2019
Feb 2019 ~ Jun 2019
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Argentina
AR
Argentina
Argentina
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Armenia
AM
Armenia
Armenia
Sep 2018 ~ Dec 2018
Sep 2018 ~ Dec 2018
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Nov 2020 ~ Jun 2022
Jul 2022 ~ Dec 2022
Nov 2020 ~ Jun 2022
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Austria
AT
Austria
Austria
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Azerbaijan
AZ
Azerbaijan
Azerbaijan
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Feb 2019 ~ Jun 2019
Feb 2019 ~ Jun 2019
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Feb 2021 ~ Mar 2021
Feb 2021 ~ Mar 2021
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Bahrain
BH
Bahrain
Bahrain
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Feb 2021 ~ Mar 2021
Nov 2020 ~ Jun 2022
Feb 2021 ~ Mar 2021
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Belarus
BY
Belarus
Belarus
Jan 2019 ~ Apr 2019
Jan 2019 ~ Apr 2019
Cambodia
KH
Cambodia
Cambodia
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Egypt
EG
Egypt
Egypt
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
May 2018 ~ May 2018
May 2018 ~ Jun 2018
Sep 2018 ~ Dec 2018
Sep 2018 ~ Dec 2018
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Europe
EU
Europe
Europe
Jan 2022 ~ Jan 2022
Jan 2022 ~ Feb 2022
Georgia
GE
Georgia
Georgia
Jan 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
India
IN
India
India
Jan 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Jan 2018 ~ Mar 2018
Jan 2018 ~ Mar 2018
Iran
IR
Iran
Iran
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Feb 2019 ~ Jun 2019
Feb 2019 ~ Jun 2019
Iraq
IQ
Iraq
Iraq
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jul 2017 ~ Oct 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jul 2017 ~ Oct 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2018 ~ May 2018
May 2018 ~ Oct 2018
Feb 2018 ~ May 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
May 2018 ~ Oct 2018
Nov 2018 ~ Apr 2019
Sep 2018 ~ Dec 2018
Mar 2019 ~ Mar 2019
Feb 2019 ~ Jun 2019
Nov 2018 ~ Apr 2019
Feb 2019 ~ Jun 2019
Dec 2019 ~ Oct 2020
Jan 2020 ~ Nov 2023
Dec 2019 ~ Oct 2020
Jan 2020 ~ Nov 2023
Dec 2019 ~ Oct 2020
Jan 2020 ~ Nov 2023
Dec 2019 ~ Oct 2020
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Israel
IL
Israel
Israel
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Dec 2019 ~ Oct 2020
Jan 2020 ~ Nov 2023
Dec 2019 ~ Oct 2020
Jan 2020 ~ Nov 2023
Dec 2019 ~ Oct 2020
Jan 2020 ~ Nov 2023
Dec 2019 ~ Oct 2020
Jan 2020 ~ Nov 2023
Feb 2021 ~ Mar 2021
Nov 2020 ~ Jun 2022
Jan 2020 ~ Nov 2023
Feb 2021 ~ Mar 2021
Nov 2020 ~ Jun 2022
Jan 2020 ~ Nov 2023
Jun 2021 ~ Dec 2021
Nov 2020 ~ Jun 2022
Jan 2020 ~ Nov 2023
Nov 2021 ~ Jun 2023
Jun 2021 ~ Dec 2021
Nov 2020 ~ Jun 2022
Jan 2020 ~ Nov 2023
Nov 2021 ~ Jun 2023
Nov 2020 ~ Jun 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Nov 2021 ~ Jun 2023
Jul 2022 ~ Aug 2022
Nov 2020 ~ Jun 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Nov 2021 ~ Jun 2023
Jul 2022 ~ Aug 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Nov 2021 ~ Jun 2023
Jan 2020 ~ Nov 2023
Nov 2021 ~ Jun 2023
Jan 2020 ~ Nov 2023
Nov 2021 ~ Jun 2023
Jan 2020 ~ Nov 2023
Oct 2023 ~ Nov 2023
Jordan
JO
Jordan
Jordan
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
May 2018 ~ Oct 2018
Oct 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
Oct 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jun 2021 ~ Dec 2021
Jan 2020 ~ Nov 2023
Jun 2021 ~ Dec 2021
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jul 2022 ~ Dec 2022
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Jan 2020 ~ Nov 2023
Kazakhstan
KZ
Kazakhstan
Kazakhstan
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Kuwait
KW
Kuwait
Kuwait
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Jan 2021 ~ Feb 2021
Jan 2021 ~ Feb 2021
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Laos
LA
Laos
Laos
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Lebanon
LB
Lebanon
Lebanon
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Nov 2018 ~ Dec 2018
Oct 2018 ~ Nov 2018
Mali
ML
Mali
Mali
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Middle East
ME
Middle East
Middle East
Jul 2017 ~ Oct 2017
Oct 2017 ~ Nov 2017
Jul 2017 ~ Oct 2017
Feb 2018 ~ May 2018
Feb 2018 ~ May 2018
Apr 2019 ~ May 2019
Apr 2019 ~ May 2019
Oct 2020 ~ May 2022
Oct 2020 ~ May 2022
Oct 2020 ~ May 2022
Jun 2021 ~ Dec 2021
Oct 2020 ~ May 2022
Jun 2021 ~ Dec 2021
Nov 2021 ~ Feb 2022
Oct 2020 ~ May 2022
Jan 2022 ~ Jan 2022
Jan 2022 ~ Feb 2022
Nov 2021 ~ Feb 2022
Jan 2022 ~ Jan 2022
Oct 2020 ~ May 2022
Jun 2022 ~ Apr 2023
Oct 2020 ~ May 2022
Jun 2022 ~ Apr 2023
Jun 2022 ~ Apr 2023
Jun 2022 ~ Apr 2023
Netherlands
NL
Netherlands
Netherlands
Sep 2018 ~ Dec 2018
Sep 2018 ~ Dec 2018
Oman
OM
Oman
Oman
Sep 2018 ~ Dec 2018
Nov 2018 ~ Dec 2018
Oct 2018 ~ Nov 2018
Sep 2018 ~ Dec 2018
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Pakistan
PK
Pakistan
Pakistan
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Oct 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2018 ~ Mar 2018
Feb 2018 ~ May 2018
Feb 2018 ~ Mar 2018
May 2018 ~ Oct 2018
Jan 2018 ~ Mar 2018
Feb 2018 ~ May 2018
Feb 2018 ~ Mar 2018
Oct 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
Oct 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Jun 2021 ~ Dec 2021
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Jun 2021 ~ Dec 2021
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Qatar
QA
Qatar
Qatar
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Russia
RU
Russia
Russia
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jul 2017 ~ Oct 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jul 2017 ~ Oct 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
May 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
Feb 2021 ~ Mar 2021
Feb 2021 ~ Mar 2021
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
South Africa
ZA
South Africa
South Africa
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Sudan
SD
Sudan
Sudan
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Syria
SY
Syria
Syria
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Nov 2020 ~ Jun 2022
Tajikistan
TJ
Tajikistan
Tajikistan
Jan 2018 ~ Mar 2018
Feb 2018 ~ Mar 2018
Jan 2018 ~ Mar 2018
Feb 2018 ~ Mar 2018
Feb 2019 ~ Jun 2019
Feb 2019 ~ Jun 2019
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Thailand
TH
Thailand
Thailand
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Tunisia
TN
Tunisia
Tunisia
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Turkey
TR
Turkey
Turkey
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2018 ~ Mar 2018
Feb 2018 ~ May 2018
Feb 2018 ~ Mar 2018
May 2018 ~ Oct 2018
Jan 2018 ~ Mar 2018
Feb 2018 ~ May 2018
Feb 2018 ~ Mar 2018
Oct 2018 ~ Oct 2018
May 2018 ~ Oct 2018
Sep 2018 ~ Dec 2018
Nov 2018 ~ Dec 2018
Oct 2018 ~ Oct 2018
Nov 2018 ~ Nov 2018
Jan 2019 ~ Apr 2019
May 2018 ~ Oct 2018
Nov 2018 ~ Apr 2019
Sep 2018 ~ Dec 2018
Jan 2019 ~ Apr 2019
Feb 2019 ~ Jun 2019
Nov 2018 ~ Apr 2019
Feb 2019 ~ Jun 2019
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Oct 2020 ~ May 2022
Oct 2020 ~ May 2022
Nov 2020 ~ Jun 2022
Oct 2020 ~ May 2022
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Oct 2020 ~ May 2022
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Oct 2020 ~ May 2022
Nov 2020 ~ Jun 2022
Jun 2021 ~ Jan 2022
Oct 2020 ~ May 2022
Nov 2020 ~ Jun 2022
Jun 2022 ~ Apr 2023
Oct 2020 ~ May 2022
Nov 2020 ~ Jun 2022
Jun 2022 ~ Apr 2023
Jun 2022 ~ Apr 2023
Jun 2022 ~ Apr 2023
Ukraine
UA
Ukraine
Ukraine
Jan 2019 ~ Apr 2019
Jan 2019 ~ Apr 2019
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Jan 2021 ~ Feb 2021
Feb 2021 ~ Mar 2021
Jan 2021 ~ Feb 2021
Feb 2021 ~ Mar 2021
Jun 2021 ~ Dec 2021
Jun 2021 ~ Dec 2021
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
Jul 2022 ~ Dec 2022
United Kingdom
GB
United Kingdom
United Kingdom
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
United States
US
United States
United States
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Jan 2017 ~ Nov 2017
Feb 2017 ~ Nov 2017
Sep 2018 ~ Dec 2018
Sep 2018 ~ Dec 2018
Apr 2019 ~ Jan 2020
Apr 2019 ~ Jan 2020
Apr 2019 ~ Jan 2020
Apr 2019 ~ Jan 2020
Jan 2022 ~ Jan 2022
Jan 2022 ~ Feb 2022
Vietnam
VN
Vietnam
Vietnam
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Dec 2019 ~ Oct 2020
Jan 2017Sep 2023

Targeted Sectors

Government Agencies and ServicesTelecommunicationInformation TechnologyOil and GasFinancialEducationDefenseTourismPoliticalHealthcareMilitaryInsuranceCommunicationFinancialsMilitary and DefenseHigh-TechScientific ResearchUniversityUtilitiesManufacturingReal EstateBanking

Recent Activities

  1. Public
    MuddyWater Upgrades: The Emergence of PhonyC2 Framework
  2. Public
    MERCURY and DEV-1084's Destructive Cyber Operations Against Cloud and On-Premises Environments
  3. Public
    Spearphishing and Syncro: The Tools of MuddyWater's Recent Cyber Attacks
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.