{"actor":{"id":"muddywater","name":"MuddyWater","aliases":["MuddyWater","STATIC KITTEN","MERCURY","Seedworm","ATK51","Earth Vetala","Boggy Serpens","ITG17"],"vendor_names":{"crowdstrike":"HELIX KITTEN","mandiant":"Temp.Zagros","microsoft":"Mango Sandstorm","mitre":"G0069","proofpoint":"TA450","secureworks":"COBALT ULSTER"},"mitre_gid":"G0069","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"IR","origins":["IR"],"targets":["AE","AF","AL","AM","AZ","DE","EG","GB","GE","IL","IN","IQ","JO","MT","NL","OM","PK","PS","SA","SY","TJ","TK","TM","TR","US"],"target_regions":["mena"],"sectors":["gov","ngo","agr","hea","pharmaceutical","tel","real-estate","def","energy-utilities","tec","fin","hospitality","avi","edu","aerospace","oil-and-gas"],"threat_types":["esp"],"mitre_techniques":["T1003","T1003.001","T1003.004","T1003.005","T1016","T1027","T1027.003","T1027.004","T1027.010","T1033","T1036.005","T1041","T1047","T1049","T1053.005","T1057","T1059","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1071.001","T1083","T1090","T1102.002","T1104","T1105","T1113","T1137.001","T1140","T1190","T1203","T1204.001","T1204.004","T1210","T1218","T1218.003","T1218.005","T1218.011","T1219.002","T1518","T1534","T1547","T1547.001","T1552.001","T1555","T1555.003","T1560","T1560.001","T1566","T1566.001","T1566.002","T1567.002","T1571","T1583.006","T1684.001","T1685"],"gir_codes":["4.4.2","5.2.1","5.2.10","5.2.5","5.2.6","5.5.1","6.1.6","6.2.5"],"active_since":2017,"brief":"Iranian MOIS-affiliated cyber-espionage and disruption group.","attribution_sponsor":null,"attribution_confidence":"confirmed","merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:24.066964+00:00","updated_at":"2026-07-29T07:06:35.687+00:00","url":"https://aptatlas.net/actors/muddywater"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/muddywater/stix","navigator":"https://aptatlas.net/api/v1/actors/muddywater/navigator"}}