Would you notice MuddyWater behind a remote-support tool you trust?
A threat group attributed to Iran's Ministry of Intelligence and Security (MOIS), active since at least 2017. It phishes its way into governments, telecoms, energy and defense and hides behind legitimate remote-access tools.
MuddyWater
- Origin
- Iran · State-sponsored
- Also known as
- Seedworm, Mango Sandstorm
- Lure
- Spearphishing How they get in
- Weapon
- Backdoors Their signature move
- Loot
- Secrets What they are after
- MITRE ATT&CK®
- MuddyWater (G0069)
Try an exercise against this group
In an exercise against a group like this one, your team meets techniques like those documented for it, in the order a real attack would take. Afterwards the report shows where the attack was stopped.
Book a demo See all threat cards
The cards describe publicly known threat groups. They say nothing about who those groups target. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK® is a registered trademark of The MITRE Corporation.