MuddyWater

THREAT ACTOR PROFILE

MuddyWater

MuddyWater is an Iranian state-sponsored espionage group linked to the Ministry of Intelligence and Security (MOIS) and active since at least 2017. It targets government and private organizations, especially telecom and defense, across the Middle East, Asia, Africa, Europe and North America.

Iran

Government

First seen

2017

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Seedworm, Mango Sandstorm, TA450: one Iranian operator

Symantec publishes its MuddyWater research under the Seedworm name, so those reports belong in the same hunt. Microsoft accounts for two more names (MERCURY and Mango Sandstorm), and one 2026 write-up notes that Google tracks the group as MUDDY ION.

We map these names to one entry in our index of state-sponsored and criminal groups, so a Seedworm hash and a TA450 domain end up in the same place.

GROUP PROFILE

Iranian MOIS espionage that borrows criminal tooling

MuddyWater has long relied on spear-phishing, public exploits like Log4j and its own malware such as POWERSTATS and BugSleep. Its 2023 and 2024 campaigns focused heavily on Israel, and it has used ransomware to spread disinformation rather than to make money.

That habit of dressing espionage up as cybercrime shows in 2026. Rapid7 found the group posing as the Chaos ransomware operation while stealing data, and another investigation ties a tenant of a Russian-speaking malware-as-a-service platform to MuddyWater.

Our records list Saudi Arabia, Israel, Turkey, Iraq, the UAE, Egypt, Georgia, India, Pakistan and the US among its targets. Symantec's Q1 2026 report adds a South Korean electronics manufacturer and an international airport.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Teams chats, signed binaries and rented loaders

The stages below come from 2026 MuddyWater activity documented in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

DinDoor on Deno, ChromElevator and BurnedGopher

Initial Access

CVES EXPLOITED

MuddyWater

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

MuddyWater

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

MuddyWater

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

2026 campaigns blur the line with cybercrime

The latest reports show MuddyWater renting criminal infrastructure, hiding behind fake installers and mixing custom implants with off-the-shelf tools.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.