muddywater-mango-sandstorm

name	muddywater-mango-sandstorm
description	Adversary-emulation profile for MuddyWater (G0069 / Mercury / Mango Sandstorm / Static Kitten / TEMP.Zagros / Seedworm), Iran's MOIS cyber-espionage actor.
allowed-tools	Bash Read Write
metadata	{"subdomain":"adversary-emulation","when_to_use":"MuddyWater, Mercury, Mango Sandstorm, Static Kitten, Seedworm, TEMP.Zagros, Earth Vetala, TA450, MuddyKrill, G0069, Iranian MOIS espionage emulation, POWERSTATS PowerShell RAT, MuddyC2Go, PhonyC2, PowGoop, Small Sieve, Mori DNS tunneling, RMM tool abuse Atera ScreenConnect SimpleHelp, spearphishing macro documents, DLL side-loading, Middle East government telecom energy targeting","tags":"muddywater, mango-sandstorm, mercury, static-kitten, seedworm, temp-zagros, mois, iran, espionage, nation-state, g0069, adversary-emulation, mitre-attack","mitre_attack":"T1548.002, T1087.002, T1583.001, T1583.006, T1071.001, T1071.004, T1560.001, T1547.001, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1555, T1555.003, T1555.004, T1132.001, T1132.002, T1074.001, T1140, T1685, T1573.001, T1573.002, T1041, T1567.002, T1190, T1203, T1210, T1083, T1590.004, T1574.001, T1105, T1559.001, T1559.002, T1534, T1036.005, T1104, T1571, T1027, T1027.003, T1027.004, T1027.007, T1027.010, T1027.013, T1588.001, T1588.002, T1137.001, T1003.001, T1003.002, T1003.003, T1003.004, T1003.005, T1003.006, T1566, T1566.001, T1566.002, T1057, T1090, T1090.002, T1219.002, T1053.005, T1113, T1684.001, T1518, T1518.001, T1218.003, T1218.005, T1218.007, T1218.010, T1218.011, T1082, T1016, T1049, T1033, T1552.001, T1204.001, T1204.002, T1204.004, T1102.001, T1102.002, T1047, T1001.001, T1005, T1012, T1018, T1029, T1036.004, T1046, T1056.001, T1056.002, T1070.004, T1078, T1106, T1110.001, T1110.003, T1112, T1114.001, T1124, T1134.001, T1135, T1195.001, T1201, T1480, T1543.003, T1550.002, T1558.001, T1558.002, T1564.003, T1569.002, T1614, T1620, T1622, T1678"}

MuddyWater (Mercury, Mango Sandstorm, Static Kitten, Seedworm, TEMP.Zagros) — Adversary Emulation Profile

MuddyWater (MITRE ATT&CK G0069) is a cyber-espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS), active since at least 2017. The group has targeted government, telecommunications, defense, oil & gas, and IT organizations across the Middle East, Central/South Asia, Africa, Europe, and North America. MuddyWater is characterized by heavy reliance on PowerShell-based backdoors (POWERSTATS and its successors), evolving custom C2 frameworks (PhonyC2 → MuddyC2Go), abuse of legitimate Remote Monitoring and Management (RMM) tools (Atera, ScreenConnect, SimpleHelp), spearphishing with macro-laden documents, and a pragmatic blend of custom and open-source post-exploitation tooling. A February 2022 joint U.S./UK advisory (CISA AA22-055A) formally attributed the group to MOIS.

Attribution & motivation

• Sponsor / nation: Islamic Republic of Iran — Ministry of Intelligence and Security (MOIS). U.S. Cyber Command's Cyber National Mission Force (CNMF) publicly linked MuddyWater to MOIS in January 2022; the February 2022 joint FBI/CISA/CNMF/NCSC-UK advisory AA22-055A formalized the attribution.
• Motivation: Primarily strategic intelligence collection (espionage) supporting Iranian state interests — political, military, and economic intelligence on regional rivals. Secondary motivations include pre-positioning for disruptive operations (the 2023 Technion "DarkBit" ransomware incident) and access brokerage (sharing/selling network access to other MOIS-aligned threat actors).
• Attribution confidence: High. Backed by U.S. government advisories (CISA AA22-055A), UK NCSC malware analysis reports, Israel National Cyber Directorate attributions, and consistent named vendor reporting (Microsoft, ESET, Deep Instinct, Cisco Talos, Symantec, ClearSky, Trend Micro, Proofpoint, Group-IB).

Targeting

• Sectors: Government and public administration; telecommunications; defense and military; oil, gas, and energy; finance and insurance; IT and managed service providers; academia and research; airlines and logistics; healthcare and pharmaceuticals.
• Regions: Primary focus on the Middle East (Israel, Saudi Arabia, UAE, Kuwait, Oman, Egypt, Turkey, Iraq, Jordan, Lebanon); Central and South Asia (Pakistan, India, Malaysia); Africa (Algeria, North/East Africa); expanding into Europe and (since 2023–2025, targeting U.S. airports, banks, software companies).