MuddyWater gets into networks with tools defenders already trust: legitimate remote monitoring and management (RMM) software, signed installers and file sharing services. US and UK government agencies describe the group as a subordinate element within Iran's Ministry of Intelligence and Security (MOIS), and its campaigns have hit telecommunications, government, defence, energy and technology organisations across the Middle East, Asia, Africa, Europe and North America. This profile sets out the group's names, targeting, ATT&CK techniques and documented campaigns as the primary sources state them, then focuses on how to detect and block remote access tool abuse and credential theft. It is for detection engineers, SOC leads, identity and endpoint teams, and intelligence analysts.
Key takeaways
- Attribution comes from governments. US Cyber Command and the 2022 joint advisory AA22-055A (FBI, CISA, CNMF and NCSC-UK, with NSA agreement) describe MuddyWater as a subordinate element within MOIS.
- Legitimate remote access software is the signature move. Proofpoint and ESET report PDF lures linking to Atera, SimpleHelp, Level and PDQ installers hosted on Egnyte, OneHub, Mega and similar services.
- Unpatched internet-facing systems are the other front door. The group has exploited Netlogon (CVE-2020-1472), Exchange (CVE-2020-0688) and Log4j 2 in SysAid servers, according to CISA and Microsoft.
- Credentials and hybrid identity are targets, not side effects. Microsoft documented credential dumping, extraction of Azure AD Connect credentials and abuse of OAuth app permissions in a 2023 destructive intrusion linked to the group.
- RMM allowlisting is the highest value control. Permitting only your approved remote access tools, and alerting on any other, removes the group's preferred foothold.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as G0069 and describes it as "a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS)", active since at least 2017. AA22-055A says it has run campaigns supporting MOIS objectives since roughly 2018 and may pass stolen data and access to the Iranian government and to other malicious actors.
| Name | Used by | Notes |
|---|---|---|
| MuddyWater | MITRE ATT&CK (G0069), CISA, US Cyber Command, ESET | Most common public name. |
| Mango Sandstorm (formerly MERCURY) | Microsoft | Renamed in April 2023; Microsoft assesses with high confidence an affiliation with MOIS. |
| TA450 | Proofpoint | Proofpoint also lists MuddyWater, Mango Sandstorm and Static Kitten. |
| Static Kitten | CrowdStrike (via MITRE and Proofpoint) | Listed as an alias in G0069. |
| Seedworm | Symantec (via MITRE) | Listed as an alias in G0069. |
| Earth Vetala, TEMP.Zagros, MuddyKrill | Other vendor naming (via MITRE) | Overlap scope varies by vendor. |
MuddyWater is distinct from other Iranian clusters such as Charming Kitten and OilRig, although ESET reported a 2025 campaign overlapping with Lyceum, an OilRig subgroup, and suggested MuddyWater may act as an initial access broker for other Iran-aligned groups. See the Charming Kitten (APT35) Threat Actor Profile and the Threat Actor Groups Guide.
Targeting and motivation
- Sectors: AA22-055A names telecommunications, defence, local government and oil and natural gas. ESET's December 2025 research adds technology, engineering, manufacturing, local government and education in Israel, plus a victim in Egypt.
- Regions: MITRE lists the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe and North America. Proofpoint reports a focus on Israeli entities since at least October 2023.
- Motivation: espionage in support of MOIS, per US and UK agencies. Microsoft also linked MERCURY to destructive activity in 2023, where a partner cluster, DEV-1084 (now Storm-1084), carried out the destruction behind the DarkBit persona, which Microsoft assessed was meant to obscure Iran's involvement.
The practical consequence: MuddyWater access can lead to data theft, hand-over to other groups or, in at least one documented case, destruction. Plan response on the assumption that any of the three is possible.
Tactics and techniques (MITRE ATT&CK)
G0069 lists over 60 techniques. The table selects the ones that shape detection; IDs are verified against ATT&CK v20.
| Tactic | Technique | How sources describe MuddyWater using it |
|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | ZIP, Excel and PDF attachments and links (AA22-055A); PDFs linking to RMM installers on file shares (Proofpoint, ESET). |
| Initial access | T1190 Exploit Public-Facing Application | Netlogon and Exchange flaws (AA22-055A); Log4j 2 in SysAid (Microsoft). |
| Initial access | T1534 Internal Spearphishing; T1684.001 Impersonation | Compromised mailboxes in target organisations and fake Microsoft security update emails (MITRE); a likely compromised .il sender (Proofpoint). |
| Execution | T1204.004 Malicious Copy and Paste | ClickFix style lures enticing victims to paste PowerShell (MITRE, citing Proofpoint 2025). |
| Execution | T1059.001 PowerShell; T1059.005 Visual Basic; T1218.011 Rundll32; T1218.005 Mshta | Obfuscated PowerShell backdoors (POWERSTATS, PowGoop) and script based loaders. |
| Persistence | T1547.001 Registry Run Keys; T1053.005 Scheduled Task; T1505.003 Web Shell (our mapping) | Run keys and scheduled tasks (AA22-055A); web shells after Log4j exploitation (Microsoft). |
| Defence impairment | T1574.001 DLL; T1685 Disable or Modify Tools | PowGoop side-loads a DLL through a Google Update executable; security tools disabled through Group Policy in 2023 (Microsoft). |
| Credential access | T1003.001 LSASS Memory; T1003.004 LSA Secrets; T1555.003 Credentials from Web Browsers | Mimikatz and LaZagne (AA22-055A); MuddyViper and browser stealers (ESET). |
| Lateral movement | T1047 Windows Management Instrumentation; T1210 Exploitation of Remote Services | WMI to run commands on other devices (Microsoft, 2022); Netlogon CVE-2020-1472 (AA22-055A). |
| Command and control | T1219.002 Remote Desktop Software; T1102.002 Bidirectional Communication | ScreenConnect, AteraAgent, SimpleHelp, Action1, Level and PDQ (MITRE); Small Sieve uses the Telegram Bot API (AA22-055A). |
| Command and control | T1090.002 External Proxy; T1571 Non-Standard Port | Tunnelling tools such as Ligolo (Microsoft). |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Rclone is listed among G0069 software. |
See the RMM Tool Security Guide and the PowerShell Security Guide for the control side of the two most common techniques.
How they abuse identities and credentials
- Local administrator creation: after exploiting SysAid, the group added a new user and elevated it to local administrator, then used that account over RDP to run Mimikatz (Microsoft, 2022).
- Service accounts in databases: Microsoft reported credentials dumped from SQL servers to obtain high-privilege service accounts. See the Credential Dumping Guide.
- Hybrid identity sync accounts: in the 2023 MERCURY and DEV-1084 intrusion, the actors used AADInternals to extract plaintext credentials from the Azure AD Connect server. Microsoft notes the connector account had single-factor authentication and, in older setups, Global Administrator rights. A second Global Administrator was reached through RDP, which bypassed MFA. The same path appears in a different actor's intrusions in the Storm-0501 Hybrid Cloud Attacks 2024. See the Microsoft Entra Connect and Cloud Sync Hardening Guide.
- OAuth applications as persistence: the actors granted a legitimate OAuth application the full_access_as_app permission with admin consent, added their own certificates to it, and searched mailboxes at scale (T1098.001 Additional Cloud Credentials, our mapping). They also gave themselves "Send on behalf" rights over a senior employee's mailbox.
- RMM agents as non-human identities: an Atera or SimpleHelp agent enrolled to an attacker tenant is a persistent, signed, remotely controlled identity on the endpoint. Treat RMM agents and their tenant IDs as identities to inventory.
- Browser and Windows credentials: ESET reports MuddyViper stealing Windows login credentials and tools targeting Chrome, Edge, Firefox and Opera saved logins.
Notable incidents
| Date (as published) | Activity | Source | Defensive lesson |
|---|---|---|---|
| January 2022 | US Cyber Command attributes MuddyWater to MOIS and releases PowGoop and Mori samples | USCYBERCOM CNMF | Several of these open-source and custom tools on one network may indicate Iranian activity. |
| February 2022 | Joint advisory AA22-055A on PowGoop, Small Sieve, Canopy (Starwhale), Mori and POWERSTATS | FBI, CISA, CNMF, NCSC-UK | Hunt the published file paths and Run keys; patch KEV-listed flaws first. |
| July 2022 (published August) | Log4j 2 exploitation of SysAid servers in Israel, eHorus RMM for C2 | Microsoft | Know where internet-facing helpdesk software runs and patch it. |
| April 2023 | Destructive attack on a hybrid environment with DEV-1084: on-premises encryption via Group Policy and NETLOGON, deletion of Azure resources | Microsoft | Protect sync servers and Global Administrators as tier 0. |
| March 2024 | Pay slip lures in PDFs linking to Atera installers on Egnyte, Onehub, Sync and TeraBox, sent from a likely compromised .il account | Proofpoint | Block unapproved RMM; watch for installers fetched from file sharing services. |
| December 2025 | MuddyViper backdoor and Fooder loader disguised as a Snake game; RMM installers including Atera, Level, PDQ and SimpleHelp | ESET | Expect better evasion; in-memory loading reduces disk artefacts. |
MITRE's G0069 entry also records the group using commercial satellite internet for C2 in late 2025 and early 2026, citing Symantec and other reporting.
Detection and defence
Detection signals
| Signal | Where to look | Why it matters |
|---|---|---|
| RMM installers or agents not on the approved list (Atera, SimpleHelp, ScreenConnect, RemoteUtilities, Level, PDQ, eHorus) | EDR software inventory, process creation, MSI install events | The group's preferred foothold and C2. |
| Downloads of ZIP or MSI from file sharing domains shortly after a PDF opens | Proxy, DNS and email gateway logs | Matches the Proofpoint and ESET lure chain; Proofpoint published DNS and TLS SNI signatures. |
| Outbound traffic from RMM agents to unknown vendor tenants | Proxy logs, RMM vendor console | Distinguishes your RMM tenant from an attacker's tenant using the same product. |
| Small Sieve artefacts: %AppData%\OutlookMicrosift\index.exe and the OutlookMicrosift Run key | EDR file and registry telemetry | Published in AA22-055A. |
| Obfuscated or encoded PowerShell | Script block logging (event 4104, our selection) | POWERSTATS, PowGoop and post-exploitation commands. |
| New local admin accounts and LSASS access | Security events 4720 and 4732 (our selection); EDR credential theft alerts | Documented after SysAid exploitation. |
| Admin consent to full_access_as_app and new app certificates | Entra audit logs | Documented mailbox access path in 2023. |
| Unusual sign-ins or activity by the directory sync account | Entra sign-in logs; identity threat detection | Microsoft listed unusual AD Connect account activity among detections. |
See the Windows Event Log Guide and the EDR Guide.
Phased defence plan
- Inventory remote access (weeks 1 to 2): list every RMM and remote desktop product in use, its owner and tenant. Anything without an owner is a finding.
- Allowlist RMM in audit mode (weeks 2 to 4): use application control to log, not block, any remote access tool other than the approved one. Review hits with IT and suppliers.
- Enforce (weeks 4 to 6): block unapproved RMM by publisher and hash, and block known RMM vendor domains at the proxy except your own tenant. Roll back by moving the policy back to audit if a business process breaks, then fix the exception properly.
- Patch the front door (continuous): prioritise CISA KEV entries on internet-facing helpdesk, mail and VPN systems; the group has used Netlogon, Exchange and Log4j flaws.
- Harden tier 0 identity (weeks 4 to 10): treat the sync server and its connector accounts as tier 0, require phishing-resistant MFA and Conditional Access for administrators, and alert on OAuth admin consent.
- Hunt and test (quarterly): run the AA22-055A and vendor indicators, then a purple team exercise on the PDF to RMM chain.
Choosing controls
- Application control versus network blocking: application control stops installation regardless of delivery, while proxy blocking also catches portable RMM binaries. Large estates should do both; small organisations get most value from blocking unapproved RMM in EDR policy.
- Organisations using a managed service provider: the provider's RMM is legitimate, so allowlist by tenant or account, not by product name alone.
- Hybrid identity: where Global Administrator rights still sit on sync accounts from older installations, removing them comes before any detection project.
Measuring it
- Unapproved RMM count: endpoints with any remote access tool outside the approved list (target zero).
- Time to contain an unapproved RMM install: from alert to isolation.
- KEV exposure: internet-facing systems with open KEV vulnerabilities past due date.
- Tier 0 hygiene: sync and Global Administrator accounts without phishing-resistant MFA.
- OAuth consent reviews: share of admin consents to high-privilege mail permissions reviewed within one business day.
Framework mapping
| Defence | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| RMM allowlisting and blocking unapproved software | CM-7, CM-11 | PR.PS-05 |
| Remote access governance | AC-17 | PR.AA-05 |
| Patch internet-facing systems | SI-2 | ID.RA-02 |
| MFA and least privilege for administrators and sync accounts | IA-2, AC-6 | PR.AA-05 |
| Endpoint, identity and network monitoring | SI-4, AU-6 | DE.CM-01, DE.CM-09, DE.AE-02 |
| Response to RMM or credential theft alerts | IR-4 | RS.AN-03 |
The mapping is NHI Mgmt Group's own; control IDs are verified against the official catalogues.
Common failure patterns
- Treating RMM alerts as IT noise: a newly installed Atera agent looks like routine administration unless the tenant is checked.
- Allowlisting by product name: attackers use the same products as your supplier, enrolled to their own tenant.
- Leaving helpdesk and ticketing servers out of patching: SysAid was the entry point in Microsoft's 2022 report.
- Over-privileged sync accounts: legacy Global Administrator rights on the connector turned an on-premises intrusion into cloud destruction.
- Trusting mail from known partners: Proofpoint saw lures sent from a likely compromised legitimate account.
Practitioner checklist
- Publish one approved RMM product and tenant, and block all others in EDR or application control.
- Alert on RMM installers downloaded from file sharing services.
- Patch KEV-listed flaws on internet-facing helpdesk, mail and VPN systems first.
- Remove Global Administrator rights from sync accounts and protect sync servers as tier 0.
- Require phishing-resistant MFA for all administrators and remote access.
- Alert on admin consent to full_access_as_app and new credentials on existing apps.
- Enable PowerShell script block logging and hunt the AA22-055A artefacts.
- Rehearse a PDF to RMM intrusion in a purple team exercise once a year.
Standards and references
- CISA, FBI, CNMF and NCSC-UK: Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks (AA22-055A)
- US Cyber Command: Iranian intel cyber suite of malware uses open source tools
- MITRE ATT&CK: MuddyWater (G0069)
- Microsoft Threat Intelligence: MERCURY and DEV-1084 destructive attack on hybrid environment
- Microsoft Threat Intelligence: MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems
- Proofpoint: TA450 uses embedded links in PDF attachments in latest campaign
- ESET: MuddyWater targets critical infrastructure in Israel and Egypt
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Threat Actor Groups Guide · Charming Kitten (APT35) Threat Actor Profile · Turla Threat Actor Profile · Remote Access Trojans (RATs) Guide · Application Allowlisting Guide