MuddyWater

MITRE G0069Also known as Seedworm, TEMP.Zagros, Static Kitten, Mango Sandstorm, TA450

Reports

First seen

Nov 6

Last seen

Jun 10

Motivation

espionage, initial-access, cyberespionage

Targeting

Sectors

other ×6

Victim regions

Israel ×2United States ×1

Top ATT&CK techniques

T1566 Phishing ×8T1190 Exploit Public-Facing Application ×7T1219 Remote Access Software ×4T1087 Account Discovery ×4T1059 Command and Scripting Interpreter ×4T1486 Data Encrypted for Impact ×4T1566.002 Phishing: Spearphishing Link ×4T1003 OS Credential Dumping ×3T1133 External Remote Services ×3T1078 Valid Accounts ×3T1598 Phishing for Information ×3T1561 Disk Wipe ×3

Indicators

filename ×34cve ×28ip_v4 ×16hash_sha256 ×6domain ×4registry_key ×3hash_md5 ×2url ×1hash_sha1 ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Path traversal flaw in Langflow AI platform actively exploited

Bleeping ComputerJun 10 High

Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE

The Hacker NewsJun 10 Critical

Check Point Threat Intelligence Report – June 2025 Breaches, Vulnerabilities, and AI Threats

Check Point ResearchJun 8 High

MuddyWater Deploys DLL Side-Loading in Multi-Country Espionage Campaign

The Hacker NewsMay 26 Critical

CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV Catalog

The Hacker NewsMay 22 High

Microsoft disrupts Fox Tempest code-signing service used by ransomware groups

CyberScoopMay 19 unrated

Check Point Research Threat Intelligence Report – 11 May

Check Point ResearchMay 11 High

CERT-EU Cyber Brief March 2026 – Espionage, Supply-Chain Attacks, Iran Conflict Disruptions

CERT-EU Threat IntelApr 1 High

Cyber fallout from the Iran war: Threat actors, tactics, and resilience measures

ESET WeLiveSecurityMar 12 High

Unmasking an Attack Chain of MuddyWater: Iranian APT Intrusion Analysis

Huntress BlogMar 6 High

Cyber Brief December 2025: Espionage, Ransomware, and Infrastructure Attacks Across Europe and Beyond

CERT-EU Threat IntelJan 5 High

MuddyWater APT: New Fooder Loader and MuddyViper Backdoor Campaign Targeting Israel and Egypt

ESET WeLiveSecurityDec 2 High

ESET APT Activity Report Q2 2025–Q3 2025

ESET WeLiveSecurityNov 6

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.