Adversary Emulation: MuddyWater
An intelligence-grounded, authorized purple-team emulation profile for MuddyWater (MITRE ATT&CK G0069), Iran's MOIS-linked cyber-espionage group — attribution, targeting, representative TTPs by ATT&CK tactic, emulation guidance mapped to generic red-team tooling, and paired detection/defense recommendations for every offensive technique, all under an explicit authorized-use caveat.
Generic red-team exercises test whether defenses catch 'an attacker' in the abstract — real purple-team value comes from emulating a specific, well-documented adversary's actual playbook, so the detections you validate are the ones that would catch the threat actor realistically targeting your sector, not a hypothetical one.
Who it's for: purple-team and red-team operators running authorized adversary emulation exercises, blue-team detection engineers validating coverage against a specific documented threat actor, security teams in government, telecom, energy, or finance sectors MuddyWater has historically targeted, SOC analysts building detections informed by real TTPs instead of generic attack patterns
Example
"Run a purple-team exercise emulating an Iranian state-linked threat actor targeting our sector" → MuddyWater's documented TTPs mapped by ATT&CK tactic (macro-document spearphishing, RMM tool abuse for initial access, PowerShell-centric execution via mshta/CMSTP proxy execution, DNS-tunneling C2), each one paired with the specific detection logic it's meant to validate, all framed under an explicit authorized-engagement caveat
New here? 3-minute setup guide → | Already set up? Copy the template below.
# Adversary Emulation Profile: MuddyWater
An intelligence-grounded adversary-emulation profile for MuddyWater (MITRE ATT&CK G0069 — also tracked as Mercury, Mango Sandstorm, Static Kitten, Seedworm, TEMP.Zagros), a cyber-espionage group assessed to be a subordinate element of Iran's Ministry of Intelligence and Security (MOIS), active since at least 2017.
**Authorized-use caveat:** apply this profile only within the documented rules of engagement, target scope, and time window of an authorized purple-team or red-team engagement. Never run disruptive actions outside an explicitly sanctioned, isolated lab.
## Profile Summary
MuddyWater targets government, telecommunications, defense, oil & gas, and IT organizations primarily across the Middle East, Central/South Asia, Africa, and increasingly Europe and North America. It is characterized by heavy reliance on PowerShell-based backdoors (POWERSTATS and successors), an evolving custom C2 framework lineage (PhonyC2 → MuddyC2Go), abuse of legitimate Remote Monitoring and Management tools (Atera, ScreenConnect, SimpleHelp), spearphishing with macro-laden documents, and a pragmatic mix of custom and open-source post-exploitation tooling. A February 2022 joint U.S./UK advisory (CISA AA22-055A) formally attributed the group to MOIS with high confidence.
**Sponsor / motivation:** Iranian MOIS, primarily for strategic intelligence collection, with secondary motivations of pre-positioning for disruptive operations (the 2023 Technion "DarkBit" ransomware incident) and access brokerage to other Iranian threat actors.
**Sectors and regions:** government, telecoms, defense, energy, finance, IT/MSPs, and academia; primary focus on the Middle East, Central/South Asia, and Africa, with expansion into Europe and North America since 2023–2025 (U.S. airports, banks, and software companies).
## Representative TTPs by ATT&CK Tactic
- **Initial Access** — Spearphishing with macro-laden Word/Excel documents and malicious PDFs (T1566.001); links to lure documents hosted on file-sharing services (T1566.002); internal spearphishing from compromised mailboxes (T1534); ClickFix-style social engineering enticing victims to paste malicious PowerShell (T1204.004).
- **Execution** — PowerShell as the core mechanism for custom backdoors, with Invoke-Obfuscation for evasion (T1059.001); VBScript/VBA macros to stage payloads (T1059.005); COM/DCOM and Outlook automation (T1559.001).
- **Persistence** — Registry Run keys with a recognizable naming pattern (`SystemTextEncoding`) (T1547.001); DLL side-loading (T1574.001); scheduled tasks and Office template (`Normal.dotm`) modification.
- **Defense Evasion** — Heavy obfuscation across custom tooling (T1027); steganography (obfuscated JS in image files) (T1027.003); proxy-execution via `mshta.exe`, `CMSTP.exe`, `regsvr32.exe`, `rundll32.exe` (T1218.*); hidden PowerShell windows.
- **Credential Access** — Mimikatz and `procdump64.exe` for LSASS dumping (T1003.001); LaZagne for broad credential recovery from browsers, email clients, and Windows Credential Manager; CrackMapExec for SAM/NTDS extraction and password spraying.
- **Command and Control** — Custom frameworks evolving from PhonyC2 (Python) to MuddyC2Go (Go); DNS tunneling (Mori malware) (T1071.004); multi-stage channels separating enumeration traffic from exfiltration.
- **Exfiltration** — Data compressed with `makecab.exe` or archive utilities; staged in `%temp%`; the more recent Dindoor/Seedworm pattern uses Rclone to sync to Wasabi/S3-compatible cloud storage.
## Emulation Guidance
Apply these authorized-only within a sanctioned engagement, mapped to whatever C2, phishing, and post-exploitation tooling your team is cleared to use — none of the following requires MuddyWater's specific malware, only equivalent technique coverage:
- **Spearphishing with macro documents** — craft macro-laden Office documents with region-appropriate decoy content; on macro-enable, decode and execute a PowerShell stager via VBA, mirroring the POWERSTATS delivery chain.
- **RMM tool abuse** — deliver an authorized RMM agent installer (Atera, ScreenConnect, or equivalent) via a spearphishing PDF with an embedded link; once installed, use the tool's own remote-access capability rather than a traditional C2 channel, since RMM traffic often evades detection tuned for custom malware.
- **PowerShell-centric post-exploitation** — run operations through heavily obfuscated PowerShell; use `mshta.exe` and `CMSTP.exe` as proxy-execution vectors to launch stagers, matching MuddyWater's defining execution pattern.
- **Persistence** — set a Registry Run key for a PowerShell callback, side-load a DLL via a legitimate application, and create an innocuously named scheduled task.
- **Credential access** — drive an LSASS dump and a broad credential-store sweep (browsers, email clients, credential manager), then attempt password spraying against discovered accounts — mirroring MuddyWater's systematic credential-harvesting approach.
- **C2** — use an HTTPS-based C2 channel as the primary vector to emulate MuddyC2Go/PhonyC2; add a DNS-tunneling channel to emulate the Mori pattern; separate enumeration traffic from exfiltration traffic across channels.
- **Exfiltration** — compress staged data before exfiltrating over C2; for the more recent pattern, sync staged data to authorized cloud storage via a sync tool.
## Detection and Defense Guidance
Pair every offensive technique above with the detection coverage it's meant to validate:
- **Spearphishing/macros** — block macros from internet-originated documents (Mark-of-the-Web enforcement); deploy attachment detonation; alert on Office processes spawning PowerShell, `cmd.exe`, `mshta.exe`, or `CMSTP.exe`.
- **RMM abuse** — maintain an allowlist of authorized RMM software; alert on unexpected RMM agent installations or RMM binaries executing from non-standard directories.
- **PowerShell backdoors** — enable PowerShell Script Block and Module Logging; apply constrained language mode on sensitive hosts; detect Invoke-Obfuscation patterns and PowerShell spawned from proxy-execution binaries.
- **DLL side-loading** — monitor for DLL loads from non-standard directories alongside legitimate executables; alert on unsigned DLLs loaded by signed binaries.
- **DNS tunneling** — monitor for high-volume DNS queries with long subdomain strings to unusual domains.
- **Credential dumping** — enable LSA protection and Credential Guard; alert on LSASS handle access and DCSync replication from non-domain-controller machines.
- **Persistence** — monitor Registry Run key modifications (especially suspicious or Defender-themed key names) and scheduled task creation.
- **Exfiltration** — monitor for sync-tool execution and cloud-storage API traffic to unusual endpoints; apply DLP rules to `makecab.exe`-generated archives.
## Sources
MITRE ATT&CK G0069; CISA Advisory AA22-055A; UK NCSC malware analysis reports; and public threat-intelligence reporting from Unit 42, Mandiant, Symantec, ClearSky, Cisco Talos, Deep Instinct, Proofpoint, and ESET.
Get new playbooks like this one
One email a week with new Claude Code workflows. Free, like everything here.
No spam. Unsubscribe anytime.
What This Does
A structured, citation-backed adversary-emulation profile for MuddyWater (MITRE ATT&CK G0069, also tracked as Mercury, Mango Sandstorm, and Static Kitten), an Iranian MOIS-linked cyber-espionage group active since at least 2017 — built for authorized purple-team and red-team exercises rather than casual reading. It opens with attribution and targeting grounded in named sources (CISA's joint advisory AA22-055A, UK NCSC malware analysis, and reporting from Unit 42, Mandiant, Symantec, and others), then walks representative TTPs by ATT&CK tactic: the group's defining reliance on PowerShell-based backdoors launched via proxy-execution binaries like mshta.exe and CMSTP.exe, its evolution from the PhonyC2 to MuddyC2Go command-and-control framework, its systematic pivot to abusing legitimate RMM tools (Atera, ScreenConnect) for initial access, and its more recent adoption of ClickFix-style social engineering and cloud-storage-based exfiltration.
Every offensive technique carries two things most emulation write-ups skip: an emulation instruction generalized to whatever C2 and phishing tooling your team is actually cleared to use (never requiring MuddyWater's specific malware), and a paired detection recommendation stating exactly what a blue team should be watching for to catch it — Script Block Logging for the PowerShell obfuscation, an RMM software allowlist for the tool abuse, DNS-query-pattern monitoring for the Mori-style tunneling. An explicit authorized-use caveat opens the emulation section: apply this only within a sanctioned engagement's documented scope, and never run disruptive actions outside an isolated, explicitly authorized lab.
Quick Start
Step 1: Create a Project Folder
mkdir adversary-emulation && cd adversary-emulation
Step 2: Download the Template
Click Download above, then:
mv ~/Downloads/CLAUDE.md ./
Step 3: Run an Authorized Exercise
claude
Within an authorized purple-team engagement, ask Claude to plan an exercise emulating MuddyWater's TTPs against your environment, or to build detection logic for a specific technique in the profile. It will map the documented TTPs to your actual authorized tooling and pair every offensive step with the detection coverage it's meant to validate.
Tips & Best Practices
- Confirm rules of engagement and scope before applying any offensive technique from this profile — the authorized-use caveat isn't boilerplate; MuddyWater's real playbook includes destructive capability (the 2023 DarkBit ransomware incident) that must never run outside a sanctioned, isolated environment.
- Use the paired detection guidance to validate coverage before running the offensive side of the exercise — knowing what "should" alert makes it obvious when a gap in logging or detection logic is the actual finding, not just whether the emulated technique succeeded.
- Treat the RMM tool abuse pattern as a priority technique to test — legitimate RMM software abuse is specifically effective at evading detection tuned for custom malware, which is exactly why MuddyWater pivoted heavily toward it.
Limitations
- Intelligence-grounded but still a synthesis of public reporting — treat it as a strong starting profile for an exercise, not a guarantee of complete coverage of the actor's full, non-public capability.
- Emulation guidance intentionally stays tool-agnostic (mapped to "your C2/phishing tooling") rather than naming a specific commercial or open-source platform — teams will need to translate each technique into their own cleared toolset.
- A profile for one specific, named threat actor — pair it with profiles of other actors relevant to your sector and with a broader detection-engineering program for coverage beyond this one group's documented TTPs.