Actors/Nation-state / APT/Asia

MuddyWater

APTIR · Iran

AKA STATIC KITTEN · MERCURY · Seedworm · ATK51 · Earth Vetala · Boggy Serpens · ITG17

CrowdStrike: HELIX KITTENMandiant: Temp.ZagrosMicrosoft: Mango SandstormProofpoint: TA450Secureworks: COBALT ULSTER

Iranian MOIS-affiliated cyber-espionage and disruption group.

Targets25

Sectors16

Threat types1

GIRs covered8/480

Active since2017

Victimology

Geographic footprint · 25 countries

origin · Irantargeted countries · 25

ASIA · 17

United Arab Emirates · Afghanistan · Armenia · Azerbaijan · Georgia · Israel · India · Iraq · Jordan · Oman · Pakistan · Palestine · Saudi Arabia · Syria · Tajikistan · Turkmenistan · Türkiye

EUROPE · 5

Albania · Germany · United Kingdom · Malta · Netherlands

AFRICA · 1

Egypt

OCEANIA · 1

Tokelau

AMERICAS · 1

United States

REGIONSMiddle East & North Africa

Sectors targeted

16 of 40

Government83 actors Defense60 actors Aerospace49 actors Aviation19 actors Financial Services61 actors Healthcare38 actors Pharmaceutical24 actors Technology51 actors Telecom57 actors NGOs & Dissidents47 actors Energy / Utilities49 actors Oil and Gas19 actors Education & Research50 actors Real Estate7 actors Hospitality26 actors Agriculture & Food15 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 58 techniques

Resource Development · 1

T1583.006Web Services

Initial Access · 4

T1190Exploit Public-Facing Application T1566Phishing T1566.001Spearphishing Attachment T1566.002Spearphishing Link

Execution · 11

T1047Windows Management Instrumentation

Persistence · 3

T1137.001Office Template Macros

Credential Access · 7

T1003OS Credential Dumping

Discovery · 6

T1016System Network Configuration Discovery

Lateral Movement · 2

T1210Exploitation of Remote Services

Collection · 3

T1113Screen Capture T1560Archive Collected Data T1560.001Archive via Utility

Exfiltration · 2

T1041Exfiltration Over C2 Channel T1567.002Exfiltration to Cloud Storage

Command And Control · 7

T1071.001Web Protocols T1090Proxy

Defense Impairment · 1

T1685Disable or Modify Tools

Stealth · 11

T1027Obfuscated Files or Information

GIR coverage

8 / 480 requirements satisfied

Open matrix

4 · 4 - Fraud, Identity Theft and Unauthorized Access

4.4.2

5 · 5 - Adversary Tactics and Activities

5.2.1 5.2.5 5.2.6 5.2.10 5.5.1

6 · 6 - Threats Impacting Industry or Region

6.1.6 6.2.5

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1059.006Python

T1059.007JavaScript

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1204.004Malicious Copy and Paste

T1547

Boot or Logon Autostart Execution

T1547.001Registry Run Keys / Startup Folder

T1003.001

LSASS Memory

T1003.004LSA Secrets

T1003.005Cached Domain Credentials

T1552.001Credentials In Files

T1555Credentials from Password Stores

T1555.003Credentials from Web Browsers

T1033

System Owner/User Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1518Software Discovery

T1534

Internal Spearphishing

T1102.002

Bidirectional Communication

T1104Multi-Stage Channels

T1105Ingress Tool Transfer

T1219.002Remote Desktop Software

T1571Non-Standard Port

T1027.003

Steganography

T1027.004Compile After Delivery

T1027.010Command Obfuscation

T1036.005Match Legitimate Resource Name or Location

T1140Deobfuscate/Decode Files or Information

T1218System Binary Proxy Execution

T1218.003CMSTP

T1218.005Mshta

T1218.011Rundll32

T1684.001Impersonation