Actors/Nation-state / APT/Asia

MuddyWater

G0069APTIR · Iran

AKA STATIC KITTEN · MERCURY · Seedworm · ATK51 · Earth Vetala · Boggy Serpens · ITG17 · Yellow Nix

CrowdStrike: HELIX KITTENMandiant: Temp.ZagrosMicrosoft: Mango SandstormMITRE: G0069Proofpoint: TA450Secureworks: COBALT ULSTER

Iranian MOIS-affiliated cyber-espionage and disruption group.

Targets25

Sectors16

Threat types1

GIRs mapped8/480

Active since2017

Explore in atlas

Also tracked as

6 vendor names · 8 other aliases

Open Rosetta Stone

CrowdStrike

HELIX KITTEN

Mandiant

Temp.Zagros

Microsoft

Mango Sandstorm

MITRE

G0069

Proofpoint

TA450

Secureworks

COBALT ULSTER

UNATTRIBUTED ALIASESSTATIC KITTENMERCURYSeedwormATK51Earth VetalaBoggy SerpensITG17Yellow Nix

Victimology

Geographic footprint · 25 countries

Export STIX

origin · Irantargeted countries · 25

ASIA · 17

United Arab Emirates · Afghanistan · Armenia · Azerbaijan · Georgia · Israel · India · Iraq · Jordan · Oman · Pakistan · Palestine · Saudi Arabia · Syria · Tajikistan · Turkmenistan · Türkiye

EUROPE · 5

Albania · Germany · United Kingdom · Malta · Netherlands

AFRICA · 1

Egypt

OCEANIA · 1

Tokelau

AMERICAS · 1

United States

REGIONSMiddle East & North Africa

Sectors targeted

16 of 40

Government100 actors Defense72 actors Aerospace58 actors Aviation22 actors Financial Services73 actors Healthcare46 actors Pharmaceutical26 actors Technology60 actors Telecom71 actors NGOs & Dissidents56 actors Energy / Utilities58 actors Oil and Gas21 actors Education & Research62 actors Real Estate9 actors Hospitality32 actors Agriculture & Food18 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 58 techniques

Resource Development · 1

T1583.006Web Services

Initial Access · 4

T1190Exploit Public-Facing Application T1566Phishing T1566.001Spearphishing Attachment T1566.002Spearphishing Link

Execution · 11

T1047Windows Management Instrumentation

Persistence · 3

T1137.001Office Template Macros

Credential Access · 7

T1003OS Credential Dumping

Discovery · 6

T1016System Network Configuration Discovery

Lateral Movement · 2

T1210Exploitation of Remote Services

Collection · 3

T1113Screen Capture T1560Archive Collected Data T1560.001Archive via Utility

Exfiltration · 2

T1041Exfiltration Over C2 Channel T1567.002Exfiltration to Cloud Storage

Command And Control · 7

T1071.001Web Protocols T1090Proxy

Defense Impairment · 1

T1685Disable or Modify Tools

Stealth · 11

T1027Obfuscated Files or Information

GIR mappings

8 / 480 requirements mapped

Open matrix

4 · 4 - Fraud, Identity Theft and Unauthorized Access

4.4.2

5 · 5 - Adversary Tactics and Activities

5.2.1 5.2.5 5.2.6 5.2.10 5.5.1

6 · 6 - Threats Impacting Industry or Region

6.1.6 6.2.5

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer58 techniques · layer format 4.5

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1059.006Python

T1059.007JavaScript

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1204.004Malicious Copy and Paste

T1547

Boot or Logon Autostart Execution

T1547.001Registry Run Keys / Startup Folder

T1003.001

LSASS Memory

T1003.004LSA Secrets

T1003.005Cached Domain Credentials

T1552.001Credentials In Files

T1555Credentials from Password Stores

T1555.003Credentials from Web Browsers

T1033

System Owner/User Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1083File and Directory Discovery

T1518Software Discovery

T1534

Internal Spearphishing

T1102.002

Bidirectional Communication

T1104Multi-Stage Channels

T1105Ingress Tool Transfer

T1219.002Remote Desktop Software

T1571Non-Standard Port

T1027.003

Steganography

T1027.004Compile After Delivery

T1027.010Command Obfuscation

T1036.005Match Legitimate Resource Name or Location

T1140Deobfuscate/Decode Files or Information

T1218System Binary Proxy Execution

T1218.003CMSTP

T1218.005Mshta

T1218.011Rundll32

T1684.001Impersonation