MuddyWater is another hacker group of cyber spies. Believed to be a subset of Iran’s Ministry of Intelligence and Security (MOIS), these Masked Actors target government entities and various enterprises. MuddyWater made a mistake in 2019, allowing Group-IB experts to identify the threat actor’s real IP address — located in Tehran. Nevertheless, they’re still at large.
A range of government and private organizations across sectors, including finance, education, transport, government, military, IT, and healthcare. Typically, these victims are in the Middle East, Asia, and NATO-affiliated countries, with notable victims in Turkey, Afghanistan, Iraq, and Azerbaijan.
No known identities. Like OilRig above, MuddyWater is an APT group affiliated with the Iranian government.
