MuddyWater G0069
Also known as Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm.
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.
Documented targeting: Financial Services, Government, Defense, Telecommunications, Aerospace
Methodology
Relevance is a match on your industry sector and technology stack against the MITRE ATT&CK v19.1 group graph (174 groups, 821 software families, 56 campaigns). It is computed deterministically from that data, with no language model in the request path. It is a relevance match, not threat-intelligence probability data: it tells you which documented actors and techniques are worth emulating for an org like yours, not a forecast that any specific group will act.
TurboPentest can autonomously exercise 2 of 68 of this actor's documented techniques today (3%). 23 are out of scope for automated testing (social engineering, denial of service, physical).
+34 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
Known software
Mimikatz, PowerSploit, POWERSTATS, Koadic, LaZagne, Empire, SHARPSTATS, CrackMapExec, ConnectWise, RemoteUtilities, Out1, Small Sieve, STARWHALE, Rclone, PowGoop, Mori, MuddyViper, Fooder, Tsundere Botnet, LP-Notes.
Emulate MuddyWater. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFrequently asked questions
Who is MuddyWater (G0069)?
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.
What sectors does MuddyWater target?
Based on MITRE ATT&CK, MuddyWater has been observed targeting Financial Services, Government, Defense, Telecommunications, Aerospace.
Can TurboPentest test for MuddyWater?
TurboPentest can autonomously exercise 2 of 68 of this actor's documented techniques today. 34 more need internal or assumed-breach access (the Adversarial-Depth tier), and the rest are out of scope for automated testing.
What does it cost to emulate MuddyWater?
An Audit-Ready pentest starts at $99 per target. If it surfaces zero actionable findings, your next pentest is free.
Reviewed by
Michel Chamberland, Founder & CEO of IntegSec. CISSP, OSCP, OSCE, with 20+ years in offensive security, alumni of IBM X-Force Red and Trustwave SpiderLabs.
Last reviewed July 30, 2026.