MuddyWater: Iran's MOIS Conglomerate — Turning Legitimate Admin Tools Into Espionage Weapons

The group that weaponises your own IT tools.

MuddyWater — also tracked as Static Kitten, Mango Sandstorm, MERCURY, Seedworm, Earth Vetala, TEMP.Zagros, TA450, Cobalt Ulster, Boggy Serpens, and Yellow Nix — is an Iranian state-sponsored cyber espionage group assessed by the US government to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Active since at least 2017, MuddyWater has targeted government agencies, telecommunications providers, defence organisations, energy companies, financial institutions, academic institutions, and healthcare entities across the Middle East, Asia, Africa, Europe, and North America.

What makes MuddyWater distinctive is not sophistication in the traditional sense — they do not develop zero-day exploits or deploy cutting-edge implants. Instead, MuddyWater has mastered the art of abusing legitimate tools. Their signature technique is deploying legitimate Remote Monitoring and Management (RMM) software — the same tools IT departments use to manage endpoints — as command-and-control infrastructure. Atera Agent, ScreenConnect, SimpleHelp, Syncro, RemoteUtilities, N-able, and Action1 have all been weaponised by MuddyWater. Because these are signed, trusted, commercially licensed applications, they bypass endpoint detection, application whitelisting, and reputation-based security controls.

Cisco Talos's assessment captures the group's structure precisely: MuddyWater is not a single team but a conglomerate of multiple smaller teams operating independently under a shared MOIS mandate. Each team focuses on specific regions, uses slightly different tooling and infection chains, but shares techniques that evolve across teams over time — likely through shared contractors or development resources. This conglomerate structure explains why MuddyWater activity is so prolific and geographically diverse: multiple teams are operating simultaneously against different target sets.

Confirmed MOIS subordination — by four governments.

Broad targeting across three continents.

MuddyWater's target set is remarkably broad — spanning government, telecoms, defence, energy, finance, academia, healthcare, IT, transport, and NGOs. Geographically, their primary focus is the Middle East (Israel, Turkey, Saudi Arabia, UAE, Iraq, Jordan, Oman, Syria), with significant operations extending to South Asia (Pakistan, India, Afghanistan), Central Asia (Tajikistan, Azerbaijan, Armenia), Europe (Netherlands, Italy, Portugal, Germany), and North America. Since October 2023, operations targeting Israel have intensified dramatically, aligning with the Hamas conflict.

Legitimate software as invisible C2.

MuddyWater's most operationally significant innovation is their systematic abuse of legitimate Remote Monitoring and Management software. Since at least 2021, they have used commercially available RMM tools as their primary command-and-control mechanism — and the list of abused platforms continues to grow.

The brilliance of this approach is its simplicity. MuddyWater eliminates the need to develop, host, and maintain custom C2 infrastructure. The RMM vendor provides the infrastructure, the encryption, the update mechanism, and the management console. The defender's challenge is distinguishing between a legitimate Atera Agent installed by their IT department and one installed by a MuddyWater phishing campaign — because the software is identical.

When legitimate tools are not enough.

While RMM tools are MuddyWater's preferred operational method, the group also maintains a substantial arsenal of custom malware — deployed when RMM tools are insufficient or when security vendors' increasing scrutiny of RMM abuse forces a tactical shift.

PowerShell, LOLBins, and legitimate services.

Beyond RMM tools, MuddyWater extensively uses Living Off the Land Binaries (LOLBins) and native Windows utilities to execute payloads, evade detection, and maintain persistence. Their PowerShell usage is particularly heavy — to the point where PowerShell monitoring is one of the most effective detection methods against MuddyWater activity.

Defending against trusted-tool abuse.

MuddyWater's reliance on legitimate tools creates a fundamental detection challenge: the tools themselves are not malicious. Defence must focus on context, behaviour, and policy rather than signatures.

Why MuddyWater's techniques matter for your assessments.

MuddyWater's tradecraft is particularly relevant to penetration testing because the group uses techniques that a competent tester should be evaluating. If a penetration test does not attempt RMM tool deployment, LOLBin abuse, and PowerShell-based payload execution, it is not testing against the techniques used by one of the most active state-sponsored groups targeting the Middle East and NATO-affiliated nations.

In our engagements, we specifically test whether: unauthorised RMM agents can be installed and establish external C2, obfuscated PowerShell payloads execute without detection, LOLBins (CMSTP, Mshta, Rundll32) can be used for payload execution, phishing emails with links to legitimate file-sharing platforms bypass email security controls, and DNS tunnelling (a technique shared with APT34) can be used for data exfiltration. These tests directly measure an organisation's resilience against MuddyWater's documented attack chain.

The bottom line.

MuddyWater is a MOIS-subordinate conglomerate of multiple teams conducting prolific cyber espionage operations across the Middle East, Europe, Asia, and North America. Their signature innovation — systematic abuse of legitimate RMM tools for command-and-control — creates a fundamental detection challenge because every component of the attack chain is a trusted, signed, commercially licensed application. No custom malware. No suspicious C2 infrastructure. No anomalous network traffic. Just a legitimate remote management tool doing exactly what it was designed to do — in the hands of an Iranian intelligence operative.

The group's evolution in 2024–2025 shows continued adaptation: BugSleep and Phoenix represent a shift to custom backdoors as security vendors increasingly monitor RMM abuse, while the return to macro-enabled Office documents demonstrates willingness to revisit older techniques when they remain effective. The late 2025 campaign targeting over 100 government entities demonstrates the scale at which MuddyWater operates.

For defenders, MuddyWater forces a rethink of what 'malicious software' looks like. The tools MuddyWater deploys are not malware — they are legitimate applications used by IT departments globally. Detection must shift from 'is this software malicious' to 'is this software authorised, expected, and behaving within policy'. Organisations that cannot answer that question for every RMM agent running in their environment have a blind spot that MuddyWater is actively, aggressively, and successfully exploiting.