菜单
Adversary-emulation profile for MuddyWater (G0069 / Mercury / Mango Sandstorm / Static Kitten / TEMP.Zagros / Seedworm), Iran's MOIS cyber-espionage actor.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill muddywater-mango-sandstorm命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
7-question gate run before promoting a finding to FINDING + opening a report. Kills weak/non-impactful findings before they reach the report stage and damage validity ratio.
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
基于 SOC 职业分类
| name | muddywater-mango-sandstorm |
| description | Adversary-emulation profile for MuddyWater (G0069 / Mercury / Mango Sandstorm / Static Kitten / TEMP.Zagros / Seedworm), Iran's MOIS cyber-espionage actor. |
| allowed-tools | Bash Read Write |
| metadata | {"subdomain":"adversary-emulation","when_to_use":"MuddyWater, Mercury, Mango Sandstorm, Static Kitten, Seedworm, TEMP.Zagros, Earth Vetala, TA450, MuddyKrill, G0069, Iranian MOIS espionage emulation, POWERSTATS PowerShell RAT, MuddyC2Go, PhonyC2, PowGoop, Small Sieve, Mori DNS tunneling, RMM tool abuse Atera ScreenConnect SimpleHelp, spearphishing macro documents, DLL side-loading, Middle East government telecom energy targeting","tags":"muddywater, mango-sandstorm, mercury, static-kitten, seedworm, temp-zagros, mois, iran, espionage, nation-state, g0069, adversary-emulation, mitre-attack","mitre_attack":"T1548.002, T1087.002, T1583.001, T1583.006, T1071.001, T1071.004, T1560.001, T1547.001, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007, T1555, T1555.003, T1555.004, T1132.001, T1132.002, T1074.001, T1140, T1685, T1573.001, T1573.002, T1041, T1567.002, T1190, T1203, T1210, T1083, T1590.004, T1574.001, T1105, T1559.001, T1559.002, T1534, T1036.005, T1104, T1571, T1027, T1027.003, T1027.004, T1027.007, T1027.010, T1027.013, T1588.001, T1588.002, T1137.001, T1003.001, T1003.002, T1003.003, T1003.004, T1003.005, T1003.006, T1566, T1566.001, T1566.002, T1057, T1090, T1090.002, T1219.002, T1053.005, T1113, T1684.001, T1518, T1518.001, T1218.003, T1218.005, T1218.007, T1218.010, T1218.011, T1082, T1016, T1049, T1033, T1552.001, T1204.001, T1204.002, T1204.004, T1102.001, T1102.002, T1047, T1001.001, T1005, T1012, T1018, T1029, T1036.004, T1046, T1056.001, T1056.002, T1070.004, T1078, T1106, T1110.001, T1110.003, T1112, T1114.001, T1124, T1134.001, T1135, T1195.001, T1201, T1480, T1543.003, T1550.002, T1558.001, T1558.002, T1564.003, T1569.002, T1614, T1620, T1622, T1678"} |
MuddyWater (MITRE ATT&CK G0069) is a cyber-espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS), active since at least 2017. The group has targeted government, telecommunications, defense, oil & gas, and IT organizations across the Middle East, Central/South Asia, Africa, Europe, and North America. MuddyWater is characterized by heavy reliance on PowerShell-based backdoors (POWERSTATS and its successors), evolving custom C2 frameworks (PhonyC2 → MuddyC2Go), abuse of legitimate Remote Monitoring and Management (RMM) tools (Atera, ScreenConnect, SimpleHelp), spearphishing with macro-laden documents, and a pragmatic blend of custom and open-source post-exploitation tooling. A February 2022 joint U.S./UK advisory (CISA AA22-055A) formally attributed the group to MOIS.
net user /domain).KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding; used by POWERSTATS, Small Sieve, STARWHALE, MuddyViper, RustyWater, and Tsundere Botnet.-WindowStyle Hidden); Koadic and Tsundere Botnet use hidden windows.net user /domain and CrackMapExec for domain account enumeration.%temp% and other directories.| Name | ATT&CK ID | Type | Public/Custom |
|---|---|---|---|
| POWERSTATS | S0223 | PowerShell-based first-stage backdoor / RAT | Custom |
| PowGoop | S1046 | PowerShell/DLL loader and C2 agent | Custom |
| Small Sieve | S1035 | Python-based Telegram Bot API backdoor | Custom |
| STARWHALE / Canopy | S1037 | VBScript-based Windows Script backdoor | Custom |
| Mori | S1047 | DLL backdoor with DNS tunneling C2 | Custom |
| SHARPSTATS | S0450 | .NET-based backdoor | Custom |
| MuddyViper | S9032 | Modular C2 implant (reflective loading) | Custom |
| Fooder | S9033 | Reflective-loading backdoor | Custom |
| LP-Notes | S9036 | Credential harvester with GUI input capture | Custom |
| RustyWater | S9037 | Rust-based implant with anti-debug | Custom |
| Tsundere Botnet | S9034 | JavaScript/PowerShell botnet framework | Custom |
| DCHSpy | S1243 | Android surveillanceware | Custom |
| Out1 | S0594 | Python-based data exfil and email collector | Custom |
| PhonyC2 | (no ATT&CK ID) | Python-based custom C2 framework (2021–2023) | Custom |
| MuddyC2Go | (no ATT&CK ID) | Go-based custom C2 framework (2023–present) | Custom |
| MuddyC3 | (no ATT&CK ID) | Python-based C2 framework (predecessor to PhonyC2) | Custom |
| DarkBeatC2 | (no ATT&CK ID) | Custom C2 framework | Custom |
| Phoenix | (no ATT&CK ID) | Lightweight backdoor implant | Custom |
| Dindoor | (no ATT&CK ID) | Backdoor used in U.S. critical-infra targeting | Custom |
| ConnectWise / ScreenConnect | S0591 | RMM tool (abused for remote access) | Public (RMM) |
| RemoteUtilities | S0592 | RMM tool (abused for remote access) | Public (RMM) |
| SimpleHelp | — | RMM tool (abused for remote access) | Public (RMM) |
| Atera Agent | — | RMM tool (abused for remote access) | Public (RMM) |
| Action1 / Level / PDQ | — | RMM tools (abused for remote access) | Public (RMM) |
| Koadic | S0250 | Post-exploitation framework (COM/JScript) | Public |
| Empire | S0363 | PowerShell/Python post-exploitation framework | Public |
| PowerSploit | S0194 | PowerShell post-exploitation modules | Public |
| CrackMapExec | S0488 | Network/AD enumeration and exploitation | Public |
| Mimikatz | S0002 | Credential dumping and Kerberos attacks | Public |
| LaZagne | S0349 | Multi-platform credential recovery | Public |
| Rclone | S1040 | Cloud sync / exfiltration tool | Public |
| Invoke-Obfuscation | — | PowerShell obfuscation framework | Public |
| go-socks5 | — | SOCKS5 proxy for firewall/NAT bypass | Public |
Authorized-use caveat: Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never run disruptive (ransomware / "DarkBit"-style) actions outside an explicitly sanctioned, isolated lab.
Map MuddyWater's signature plays to Decepticon's own capabilities:
mshta.exe (T1218.005) and CMSTP.exe (T1218.003) as proxy-execution vectors to launch PowerShell stagers — this is MuddyWater's defining execution pattern.SystemTextEncoding pattern) for PowerShell callbacks; side-load a DLL via a legitimate application for persistence; create scheduled tasks with innocuous names; modify Normal.dotm for Office template persistence.csc.exe; chain proxy-execution binaries (mshta → PowerShell → rundll32); decode Base64 payloads at runtime. Use hidden PowerShell windows (-WindowStyle Hidden) throughout.net user /domain). Lateral-move via pass-the-hash (CrackMapExec/Mimikatz) and exploit Zerologon (CVE-2020-1472) where in scope.makecab.exe or archive utilities; exfiltrate over C2. For the Dindoor/Rclone pattern, use Rclone to sync collected data to cloud storage (Wasabi/S3-compatible). Stage data in %temp% before exfiltration.-WindowStyle Hidden); monitor for PowerShell executing from mshta.exe, CMSTP.exe, or rundll32.exe parent processes.SystemTextEncoding or Windows-Defender-themed keys); audit scheduled task creation; monitor Normal.dotm modification timestamps.makecab.exe archives; alert on large data transfers from staging directories.