# MuddyWater APT (Iran MOIS-linked, G0069) abuses legitimate RMM tools, VBA macro loaders, and Rust-compiled payloads in ongoing global espionage campaign

> Genians reports MuddyWater, an Iranian MOIS-linked APT group tracked as G0069 (aka Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill), continuing spear-phishing campaigns using VBA macro loaders, PowerShell backdoors, and Rust-compiled payloads while abusing legitimate remote monitoring and management (RMM) tools (Syncro, Atera, Remote Utilities, ScreenConnect, SimpleHelp, N-Able, PDQ Connect, Level, Splashtop) for SYSTEM-level persistence and remote access. Campaigns span telecommunications, government/diplomatic, education, IT services, finance, and energy sectors across the Middle East, Central Asia, Europe, and North America, documented from 2019 through 2026.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1530
- **ID:** TL-2026-1530
- **Severity:** HIGH
- **Category:** THREAT_ACTOR
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 78 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MuddyWater (MITRE ATT&CK G0069) is a cyber-espionage group assessed as a subordinate element within Iran's Ministry of Intelligence and Security (MOIS), active since at least 2017. The group's core tradecraft centers on spear-phishing delivery of VBA macro-laden Office documents (.doc/.docm) that trigger on Document_Open(), reconstruct hex/ASCII-encoded payloads inside UserForm objects, and spawn processes via WMI (Win32_Process) using obfuscated WScript.Shell command execution. Alongside macro loaders, MuddyWater sends HTML attachments with embedded links redirecting victims to cloud storage (OneDrive, Dropbox, Egnyte, Sync.com, Zendesk Chat/Zopim, OnHub) hosting malicious RMM installers packaged as legitimate software, and distributes encrypted RAR/ZIP archives to bypass email security scanning.

A defining and evolving TTP is the group's systematic abuse of commercial RMM platforms as first-stage payloads: since 2021 the group has cycled through ScreenConnect (ConnectWise), Syncro, SimpleHelp, Remote Utilities, Atera Agent, PDQ Connect, Level, and Splashtop, most recently exploiting Atera's free-trial signup flow (no email verification required) between October 2023 and April 2024 to stand up cloud-based C2 infrastructure without needing attacker-owned servers. These RMM tools grant SYSTEM-level remote access, file transfer, and remote shell capability while blending into normal administrative network traffic, defeating signature-based perimeter defenses. The group places a high operational priority on compromising legitimate business email accounts, which it leverages both to increase spear-phishing credibility and to maintain persistent, trusted access inside target organizations.

Through 2024-2026 the group has progressively shifted from commodity RMM abuse toward purpose-built Rust-compiled malware (RustyWater family), reflecting a deliberate operational-security and target-specificity upgrade. Rust payloads observed in November 2025 (Israeli IT provider, filename PhotoAcq.log) embed XOR-encrypted binaries in the .rdata section, enumerate 28 security products before execution, and communicate over encrypted HTTPS/TLS via SSPI contexts; PDB metadata strings such as "phoenix.pdb" have been recovered from samples.

Documented campaign activity spans an Iraqi telecom operator (March 2019, Word macro spear-phishing), a Jordanian university (April 2019, OpenXML external-template remote-template injection), Egyptian hosting/Israeli insurance/Malaysian pension-fund targets (Q4 2022-Q2 2023, HTML + OneDrive redirection), an Israeli university (April 2024, Syncro MSI installer plus encrypted RAR), Omani-impersonating diplomatic lures against foreign ministries and UN-affiliated organizations (August 2025), the November 2025 Rust-payload intrusion at an Israeli IT services provider, and a January 2026 Central Asia telecom-sector campaign using a Cybersecurity.doc dropper. MuddyWater's malware arsenal additionally includes POWERSTATS, PowGoop, SHARPSTATS, Small Sieve, STARWHALE, Mori, MuddyViper, Fooder, Tsundere Botnet, LP-Notes, and the Android surveillanceware DCHSpy, plus reliance on publicly available offensive tooling (Mimikatz, LaZagne, CrackMapExec, PowerSploit, Empire, Koadic, Rclone, Out1) for credential access and post-exploitation.

Attribution to MOIS rests on consistent Middle East-centric targeting of government and diplomatic institutions, multi-year reuse of attack infrastructure, operational tempo consistent with a state-directed unit, and sustained TTP overlap with previously identified Iran-nexus activity. No CVE/CVSS applies: initial access is achieved via phishing and legitimate-tool abuse rather than vulnerability exploitation.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1566 Phishing
- T1534 Internal Spearphishing
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1218 System Binary Proxy Execution
- T1547 Boot or Logon Autostart Execution
- T1137 Office Application Startup
- T1574 Hijack Execution Flow
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1110 Brute Force
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1087 Account Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1518 Software Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1113 Screen Capture
- T1114 Email Collection
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1219 Remote Access Tools
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1560 Archive Collected Data

## Sources

- [Chronology of MuddyWater APT Attacks Targeting the Middle East](https://www.genians.co.kr/en/blog/threat_intelligence/muddywater-apt)
- [MuddyWater campaign abusing Atera Agents](https://harfanglab.io/insidethelab/muddywater-rmm-campaign/)
- [MuddyWater, Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill, Group G0069](https://attack.mitre.org/groups/G0069/)
- [MuddyWater Hackers Abusing Legitimate RMM Tool to Deliver Malware](https://cybersecuritynews.com/muddywater-hackers-abusing-rmm-tool-deliver-malware/)
- [MuddyWater Threat Actor Profile 2026: TTPs and Defenses](https://www.stingrai.io/blog/muddywater-threat-actor-profile)
- [The Iranian Cyber Capability 2026](https://www.trellix.com/blogs/research/the-iranian-cyber-capability-2026/)
- [Advisory Alert: The 2026 MuddyWater Threat and How Iranian Hackers Are Bypassing Modern Security](https://lumu.io/blog/2026-muddywater-threat-iranian-hackers/)
- [New MuddyWater Campaigns After Operation Swords of Iron](https://www.malwation.com/blog/new-muddywater-campaigns-after-operation-swords-of-iron)
- [Unmasking MuddyWater ConnectWise ScreenConnect Installer](https://medium.com/@simone.kraus/unmasking-muddywater-connectwise-screenconnect-installer-ce05e2e63115)
- [MuddyWater (G0069) Iranian APT Explained](https://www.securityscientist.net/blog/12-questions-and-answers-about-muddywater-g0069/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1530