[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTQqvSHjTgAdialPWvCKnpCTHrMz6cYL7XCw_eNMGutw":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":20,"country":21,"suspected_sponsor":22,"target_industries":23,"target_countries":25,"incident_types":35,"references":37,"techniques":54,"technique_count":137,"created_at":138,"seoMetadata":139,"schemaOrg":143},"MuddyWater","muddywater",[9,10,11,12,13,14,15,16,17,18,19],"TEMP.Zagros","Static Kitten","Seedworm","MERCURY","COBALT ULSTER","G0069","ATK51","Boggy Serpens","Mango Sandstorm","TA450","Earth Vetala","The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.","IR","Iran (Islamic Republic of)",[24],"Government",[26,27,28,29,30,31,32,33,34],"Saudi Arabia","Georgia","Turkey","Iraq","Israel","India","United Arab Emirates","Pakistan","United States",[36],"Espionage",[38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53],"https:\u002F\u002Funit42.paloaltonetworks.com\u002Funit42-muddying-the-water-targeted-attacks-in-the-middle-east\u002F","https:\u002F\u002Fwww.cfr.org\u002Finteractive\u002Fcyber-operations\u002Fmuddywater","https:\u002F\u002Fwww.fireeye.com\u002Fblog\u002Fthreat-research\u002F2018\u002F03\u002Firanian-threat-group-updates-ttps-in-spear-phishing-campaign.html","https:\u002F\u002Fblog.trendmicro.com\u002Ftrendlabs-security-intelligence\u002Fcampaign-possibly-connected-muddywater-surfaces-middle-east-central-asia\u002F","https:\u002F\u002Fblog.trendmicro.com\u002Ftrendlabs-security-intelligence\u002Fanother-potential-muddywater-campaign-uses-powershell-based-prb-backdoor\u002F","https:\u002F\u002Fsecurelist.com\u002Fmuddywater\u002F88059\u002F","https:\u002F\u002Fwww.symantec.com\u002Fblogs\u002Fthreat-intelligence\u002Fseedworm-espionage-group","https:\u002F\u002Fwww.clearskysec.com\u002Fwp-content\u002Fuploads\u002F2018\u002F11\u002FMuddyWater-Operations-in-Lebanon-and-Oman.pdf","https:\u002F\u002Fwww.clearskysec.com\u002Fmuddywater-targets-kurdish-groups-turkish-orgs\u002F","https:\u002F\u002Fblog.talosintelligence.com\u002F2019\u002F05\u002Frecent-muddywater-associated-blackwater.html","https:\u002F\u002Fwww.zdnet.com\u002Farticle\u002Fnew-leaks-of-iranian-cyber-espionage-operations-hit-telegram-and-the-dark-web\u002F","https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0069\u002F","http:\u002F\u002Fwww.secureworks.com\u002Fresearch\u002Fthreat-profiles\u002Fcobalt-ulster","https:\u002F\u002Funit42.paloaltonetworks.com\u002Fatoms\u002Fboggyserpens\u002F","https:\u002F\u002Fwww.sentinelone.com\u002Fblog\u002Fthe-new-frontline-of-geopolitics-understanding-the-rise-of-state-sponsored-cyber-attacks\u002F","https:\u002F\u002Fwww.trendmicro.com\u002Fen_us\u002Fresearch\u002F21\u002Fc\u002Fearth-vetala---muddywater-continues-to-target-organizations-in-t.html",[55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136],"T1053","T1548","T1548.002","T1087","T1087.002","T1583","T1583.006","T1071","T1071.001","T1560","T1560.001","T1547","T1547.001","T1059","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1555","T1555.003","T1132","T1132.001","T1074","T1074.001","T1140","T1573","T1573.001","T1041","T1190","T1203","T1210","T1083","T1574","T1105","T1559","T1559.001","T1559.002","T1036","T1036.005","T1104","T1027","T1027.003","T1027.004","T1027.010","T1588","T1588.002","T1137","T1137.001","T1003","T1003.001","T1003.004","T1003.005","T1566","T1566.001","T1566.002","T1057","T1090","T1090.002","T1219","T1053.005","T1113","T1518","T1518.001","T1218","T1218.003","T1218.005","T1218.011","T1082","T1016","T1049","T1033","T1552","T1552.001","T1204","T1204.001","T1204.002","T1102","T1102.002","T1047","T1574.001","T1685",82,"2023-08-09T17:25:09.409843+00:00",{"title":140,"metaDescription":141,"keywords":142},"MuddyWater Threat Actor Profile | EdgeProtect","The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, in...","MuddyWater, TEMP.Zagros, Static Kitten, Seedworm, MERCURY, COBALT ULSTER, G0069, ATK51, Boggy Serpens, Mango Sandstorm, TA450, Earth Vetala, threat actor, APT, cyber threat, threat intelligence, Government, Iran (Islamic Republic of), IR",{"@context":144,"@type":145,"name":6,"alternateName":146,"description":20,"url":147,"mainEntityOfPage":148,"location":150},"https:\u002F\u002Fschema.org","Organization",[9,10,11,12,13,14,15,16,17,18,19],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fmuddywater",{"@type":149,"@id":147},"WebPage",{"@type":151,"name":21},"Country"]