Sign in Subscribe

MuddyWater

MuddyWater is an Iran-aligned espionage group linked to Iran's Ministry of Intelligence and Security (MOIS). Also tracked as Mango Sandstorm, Mercury, Static Kitten, Seedworm, and TA450 depending on the reporting vendor.

Trending Topics

Trending Topics

PAN-OS zero-day CVE-2026-0300 exposes firewalls to root takeover. MuddyWater abuses Microsoft Teams for espionage. Instructure Canvas breach exposes student data. Calendar invite phishing rises. OceanLotus (APT32) delivers ZiChatBot via PyPI.

Trending Topics

Trending Topics

HanGhost loader targets finance and logistics staff via fileless attacks. Nginx UI flaw CVE-2026-27944 exposes full server backups. MuddyWater (Mango Sandstorm, TA450) refines tooling for Middle East espionage. Google Cloud Storage abused for phishing redirects. April Patch Tuesday fixes 167 flaws.

Trending Topics

Trending Topics

Docker Engine flaw CVE-2026-34040 enables host takeover. Forest Blizzard (Fancy Bear) hijacks SOHO routers for surveillance. Contagious Interview poisons 1,700 packages, tied to BlueNoroff (UNC1069). OpenSSL RSA KEM leaks key data.

Surge In Cyber Threats - Middle East Activities

Threat Intelligence

Surge In Cyber Threats - Middle East Activities

Iran's IRGC- and MOIS-aligned APTs, including APT34 (OilRig) and MuddyWater, run synchronized espionage, DDoS, and ICS/OT intrusions alongside hacktivist proxies during the Israel-Iran conflict, with confirmed access claims against Gulf energy and water utilities.

Trending Topics

Iran-US/Israel Conflict

Trending Topics

Iranian APT escalation (MuddyWater, OilRig, APT33) targets critical infrastructure post-Operation Lion's Roar. Qilin and INC Ransom target law and accounting firms. Fake Zoom/Google Meet pages deploy Teramind monitoring software.

Trending Topics

Trending Topics

MuddyWater (Mango Sandstorm, TA450) refines tooling with new Fooder loader and MuddyViper backdoor. Calendly-themed phishing targets Google Workspace and Facebook ad accounts. Matanbuchus v3.0 adds Protobuf encryption.

Trending Topics

Trending Topics

SmudgedSerpent targets U.S. Iran policy experts, tied to Charming Kitten and MuddyWater. Scattered Spider (UNC3944), LAPSUS$, and ShinyHunters (UNC6040) merge into a cybercrime alliance. NGate enables NFC-relay ATM theft. APT-C-60 refines VHDX phishing.

Trending Topics

Trending Topics

DeskRAT targets Indian government Linux systems via TransparentTribe (APT36). MuddyWater expands espionage beyond the Middle East using Phoenix v4 backdoor. Warlock ransomware ties APT27 (Budworm) and APT31 (Sheathminer) to Chinese hybrid cybercrime.

Trending Topics

Global Group Ransomware

Trending Topics

GLOBAL GROUP ransomware surfaces as cross-platform RaaS. Android malware blends click fraud and credential theft. MuddyWater (Mango Sandstorm, Mercury, Static Kitten) revives DCHSpy Android spyware. Greedy Sponge targets Mexican banks with AllaKore RAT.

Trending Topics

Trending Topics

Oracle legacy server breach prompts CISA advisory on credential reuse. SonicWall SMA flaw actively exploited, CISA mandates patching. Agent Tesla returns with fileless multi-stage delivery. TA427 (Kimsuky) and TA450 (MuddyWater) adopt ClickFix for state-sponsored phishing.