MuddyWater

Local Data Staging

MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.(Citation: Talos MuddyWater Jan 2022)

Screen Capture

MuddyWater has used malware that can capture screenshots of the victim’s machine.(Citation: Securelist MuddyWater Oct 2018)

Archive via Utility

MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.(Citation: Symantec MuddyWater Dec 2018)

Web Protocols

MuddyWater has used HTTP for C2 communications.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)

Proxy

MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France.(Citation: FalconFeeds_Iran_Mar2026)

External Proxy

MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location.(Citation: Symantec MuddyWater Dec 2018) MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021) MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT), to communicate with a hardcoded C2 server, and to exfiltrate data.(Citation: ESET_MuddyWater_Dec2025)

Bidirectional Communication

MuddyWater has used web services including OneHub to distribute remote access tools.(Citation: Anomali Static Kitten February 2021)

Multi-Stage Channels

MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.(Citation: Talos MuddyWater May 2019)

Ingress Tool Transfer

MuddyWater has used malware that can upload additional files to the victim’s machine.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021) MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data.(Citation: NaumaanProofpoint_GlobalClickFix_April2025)

Standard Encoding

MuddyWater has used tools to encode C2 communications including Base64 encoding.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)

Remote Desktop Software

MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration.(Citation: Trend Micro Muddy Water March 2021)(Citation: Anomali Static Kitten February 2021)(Citation: Proofpoint TA450 Phishing March 2024)(Citation: group-ib_muddywater_infra)(Citation: FalconFeeds_Iran_Mar2026)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)(Citation: FalconFeeds_MuddyWaterPSRust_Mar2026)

Non-Standard Port

MuddyWater has used ports 8043 and 8848 for botnet C2 communication.(Citation: FalconFeeds_MuddyWaterPSRust_Mar2026)

Symmetric Cryptography

MuddyWater has used AES to encrypt C2 responses.(Citation: Talos MuddyWater Jan 2022)

LSASS Memory

MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)

LSA Secrets

MuddyWater has performed credential dumping with LaZagne.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)

Cached Domain Credentials

MuddyWater has performed credential dumping with LaZagne.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)

Credentials In Files

MuddyWater has run a tool that steals passwords saved in victim email.(Citation: Symantec MuddyWater Dec 2018)

Credentials from Password Stores

MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)

Credentials from Web Browsers

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)

Disable or Modify Tools

MuddyWater can disable the system's local proxy settings.(Citation: Trend Micro Muddy Water March 2021)

System Network Configuration Discovery

MuddyWater has used malware to collect the victim’s IP address and domain name.(Citation: Securelist MuddyWater Oct 2018)

System Owner/User Discovery

MuddyWater has used malware that can collect the victim’s username.(Citation: Securelist MuddyWater Oct 2018)(Citation: Trend Micro Muddy Water March 2021)

System Network Connections Discovery

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.(Citation: Trend Micro Muddy Water March 2021)

Process Discovery

MuddyWater has used malware to obtain a list of running processes on the system.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)

System Information Discovery

MuddyWater has used malware that can collect the victim’s OS version and machine name.(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)

File and Directory Discovery

MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."(Citation: Securelist MuddyWater Oct 2018)

Domain Account

MuddyWater has used <code>cmd.exe net user /domain</code> to enumerate domain users.(Citation: Trend Micro Muddy Water March 2021)

Software Discovery

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.(Citation: Trend Micro Muddy Water March 2021)

Security Software Discovery

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.(Citation: Securelist MuddyWater Oct 2018)

Windows Management Instrumentation

MuddyWater has used malware that leveraged WMI for execution and querying host information.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Talos MuddyWater May 2019)(Citation: DHS CISA AA22-055A MuddyWater February 2022)

Scheduled Task

MuddyWater has used scheduled tasks to establish persistence.(Citation: Reaqta MuddyWater November 2017)

PowerShell

MuddyWater has used PowerShell for execution.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Talos MuddyWater May 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)

Windows Command Shell

MuddyWater has used a custom tool for creating reverse shells.(Citation: Symantec MuddyWater Dec 2018)

Visual Basic

MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)

Python

MuddyWater has developed tools in Python including Out1.(Citation: Trend Micro Muddy Water March 2021)

JavaScript

MuddyWater has used JavaScript files to execute its POWERSTATS payload.(Citation: ClearSky MuddyWater Nov 2018)(Citation: FireEye MuddyWater Mar 2018)(Citation: DHS CISA AA22-055A MuddyWater February 2022)

Exploitation for Client Execution

MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.(Citation: ClearSky MuddyWater June 2019)

Malicious Link

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)(Citation: Proofpoint TA450 Phishing March 2024)

Malicious File

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)(Citation: Proofpoint TA450 Phishing March 2024) Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.(Citation: CloudSEK_RustyWater_Jan2026)

Malicious Copy and Paste

MuddyWater has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code.(Citation: NaumaanProofpoint_GlobalClickFix_April2025)

Component Object Model

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: DHS CISA AA22-055A MuddyWater February 2022)

Dynamic Data Exchange

MuddyWater has used malware that can execute PowerShell scripts via DDE.(Citation: Securelist MuddyWater Oct 2018)

Exfiltration Over C2 Channel

MuddyWater has used C2 infrastructure to receive exfiltrated data.(Citation: Reaqta MuddyWater November 2017)

Exfiltration to Cloud Storage

MuddyWater has attempted to exfiltrate data to Wasabi, a cloud storage service, using Rclone.(Citation: SOCRadar_MuddyWaterDindoor_Mar2026)

Exploit Public-Facing Application

MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).(Citation: DHS CISA AA22-055A MuddyWater February 2022)

Phishing

MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com.(Citation: NaumaanProofpoint_GlobalClickFix_April2025)

Spearphishing Attachment

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Proofpoint TA450 Phishing March 2024)(Citation: ESET_MuddyWater_Dec2025)(Citation: SOCRadar_MuddyWaterDindoor_Mar2026) MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.(Citation: CloudSEK_RustyWater_Jan2026)

Spearphishing Link

MuddyWater has sent targeted spearphishing e-mails with malicious links.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)(Citation: Proofpoint TA450 Phishing March 2024)

Exploitation of Remote Services

MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).(Citation: DHS CISA AA22-055A MuddyWater February 2022)

Internal Spearphishing

MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails.(Citation: FalconFeeds_Iran_Mar2026)

Office Template Macros

MuddyWater has used a Word Template, Normal.dotm, for persistence.(Citation: Reaqta MuddyWater November 2017)

Registry Run Keys / Startup Folder

MuddyWater has added Registry Run key <code>KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding</code> to establish persistence.(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)

Bypass User Account Control

MuddyWater uses various techniques to bypass UAC.(Citation: ClearSky MuddyWater Nov 2018)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)

Network Topology

MuddyWater has mapped target networks; access to this information and more is then shared/sold to other Iran threat actors.(Citation: FalconFeeds_MuddyWaterPSRust_Mar2026)

Domains

MuddyWater has established domains, some of which appeared to spoof legitimate domains for use in operations.(Citation: NaumaanProofpoint_GlobalClickFix_April2025)

Web Services

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)(Citation: Proofpoint TA450 Phishing March 2024)(Citation: ESET_MuddyWater_Dec2025)

Malware

MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals.(Citation: Huntio_IranInfra_Mar2026)

Tool

MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.(Citation: Anomali Static Kitten February 2021)(Citation: group-ib_muddywater_infra)(Citation: ESET_MuddyWater_Dec2025)(Citation: NaumaanProofpoint_GlobalClickFix_April2025)

Steganography

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.(Citation: ClearSky MuddyWater Nov 2018)

Compile After Delivery

MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.(Citation: ClearSky MuddyWater Nov 2018)

Command Obfuscation

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: GitHub Invoke-Obfuscation) The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)

Match Legitimate Resource Name or Location

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.(Citation: FireEye MuddyWater Mar 2018)(Citation: Talos MuddyWater May 2019)(Citation: Anomali Static Kitten February 2021)

Deobfuscate/Decode Files or Information

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Talos MuddyWater Jan 2022)

CMSTP

MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.(Citation: FireEye MuddyWater Mar 2018)

Mshta

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)

Rundll32

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.(Citation: Securelist MuddyWater Oct 2018)

DLL

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.(Citation: DHS CISA AA22-055A MuddyWater February 2022)

Impersonation

MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft.(Citation: NaumaanProofpoint_GlobalClickFix_April2025) MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.(Citation: CloudSEK_RustyWater_Jan2026)