# MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns Targeting the Middle East and Global Organizations

> Genians chronology of MuddyWater APT activity (2019-2026), assessed as affiliated with Iran's Ministry of Intelligence and Security (MOIS). The group uses spear-phishing with malicious Word documents (VBA macros, external template loading), PowerShell and Rust-based payloads, and legitimate RMM tools for long-term access and intelligence collection against telecom, academic, insurance, IT-services and diplomatic targets.

- **Published:** 2026-11-01T00:21:52Z
- **Last reviewed:** 2026-11-01T00:21:52Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4940
- **ID:** TL-2026-4940
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MuddyWater was first named by Palo Alto Networks Unit 42 in November 2017 and is assessed by Genians as affiliated with Iran's Ministry of Intelligence and Security (MOIS). CISA, FBI, CNMF and NCSC-UK jointly described it in advisory AA22-055A (24 February 2022) as a subordinate element within MOIS. The Genians chronology documents a consistent focus on long-term infiltration and intelligence collection across the Middle East, with expansion to global diplomatic and UN-affiliated targets.

Early cases (2019) used spear-phishing Word documents with VBA macros that launched PowerShell backdoors. In March 2019 an Iraqi mobile network operator was targeted with a macro document using blurred-image social engineering. In April 2019 a Jordanian university member received a document impersonating the Civil Status and Passport Department (cspd.gov.jo) that loaded a remote template via an OpenXML attachedTemplate relationship, and the VBA then invoked PowerShell.

From late 2022 the group shifted to legitimate remote monitoring and management (RMM) tools. Egyptian IT/hosting (October 2022), three Israeli insurers (November 2022) and a Malaysian pension fund official (April 2023) received HTML attachments or Dropbox/OneDrive links delivering ZIP archives containing a Syncro MSI installer. In April 2024, 27 Israeli university mailboxes were targeted from a compromised university account with a password-protected RAR (password 123456, given in the email body) containing an Atera installer (digitalform.msi). Genians also documents abuse of Remote Utilities, ScreenConnect, SimpleHelp, N-Able, Splashtop, AnyDesk and TeamViewer.

In 2025-2026 the group delivered custom payloads from macro documents. On 19 August 2025 hundreds of recipients, including foreign ministries, embassies and UN-affiliated organisations, received an 'official invitation' impersonating Oman's Ministry of Foreign Affairs (lure: Iran-Israel war seminar; Online Seminar.FM.gov.om.doc). Document_Open() decoded a payload into C:\Users\Public\Documents\ManagerProc.log; the implant collects username, computer name and privilege level and beacons to screenai[.]online. On 17 November 2025 a Hebrew-language email ('New company guidelines and regulations') carrying Webinar.doc targeted an Israeli IT/security/remote-support provider. The macro (love_me_) dropped PhotoAcq.log to the Downloads folder and launched it via WMI Win32_Process. The payload is a Rust binary with a SentinelOne icon (PDB path ...\phonix\phoenix\x64\Release\phoenix.pdb). It enumerates 28 security vendors, runs whoami.exe, hostname.exe and nslookup.exe, and talks HTTPS (SSPI TLS) to stratioai[.]org (159.198.68.25). On 5 January 2026 'New Cybersecurity Guidelines' emails impersonating a Turkmenistan state-owned mobile operator carried Cybersecurity.doc, which dropped C:\ProgramData\CertificationKit.ini (a Rust x64 EXE with a Cloudflare icon, original name reddit.exe) and executed it with cmd.exe /c; C2 is nomercys.it[.]com (159.198.66.153). This activity corresponds to the RustyWater/Archer RAT implant reported by CloudSEK in January 2026.

Related 2026 reporting by Group-IB (Operation Olalampo, first observed 26 January 2026) attributes GhostFetch, GhostBackDoor, HTTP_VIP and the Rust backdoor CHAR (Telegram-bot controlled) to MuddyWater with high confidence. This is context only; those samples are not part of the Genians IOC set.

Detection should focus on Office-spawned process chains (WINWORD -> WMI/cmd -> file with .log/.ini extension executing as PE), remote template fetches by Office, unsanctioned RMM installer execution, and egress to the listed infrastructure. Note: Genians lists 51 MD5 hashes; the 39 retrievable were reviewed and 10 representative values are recorded here.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1547.001 Registry Run Keys / Startup Folder
- T1221 Template Injection
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1518.001 Security Software Discovery
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1071.001 Web Protocols
- T1219 Remote Access Tools

## Sources

- [Chronology of MuddyWater APT Attacks Targeting the Middle East](https://www.genians.co.kr/en/blog/threat_intelligence/muddywater-apt)
- [MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors](https://thehackernews.com/2026/01/muddywater-launches-rustywater-rat-via.html)
- [Operation Olalampo: MuddyWater (Group-IB)](https://www.group-ib.com/blog/muddywater-operation-olalampo/)
- [MuddyWater Targets MENA Organizations (The Hacker News)](https://thehackernews.com/2026/02/muddywater-targets-mena-organizations.html)
- [Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations (AA22-055A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a)
- [Muddying the Water: Targeted Attacks in the Middle East (Unit 42)](https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4940