MuddyWater has been one of the most persistently active Iranian threat actors for nearly a decade. Targeting government agencies, financial institutions, healthcare providers, and technology firms across the Middle East and Africa — and, since early 2025, with increasing urgency across Europe — the group’s defining characteristic is continuous retooling. Every major campaign Group-IB has documented introduced new malware variants, infrastructure configurations, or delivery mechanisms, making static signature-based detection fundamentally unreliable against this actor.
Group-IB’s research into MuddyWater covers an unbroken chain of first-party investigation from 2024 through 2026, culminating in the original attribution of Operation Olalampo: a campaign first observed in January 2026 that introduced a Telegram-based command-and-control channel not previously documented in the group’s tradecraft. Between October 2025 and March 2026 alone, Group-IB documented at least three distinct MuddyWater campaigns — each deploying previously undocumented malware variants, and also utilizing commodity malware from the cybercrime ecosystem
What makes MuddyWater unusual even for a state-sponsored actor is the aggressive use of all available means to achieve their objectives; they utilize custom malware, open source offensive tools, dual use utilities like RMMs, commodity malware including ransomware. This makes it harder for them to maintain stealth, as they showed a tendency to prioritize rapid operations over stealthy operations – this results in OPSEC mistakes through which we are able to closely track their malicious activities.
Key Numbers:
— Active since 2017 — 9+ years of continuous operations
— 48 targeted industry sectors confirmed
— 113 countries with confirmed activity
— 3 distinct campaigns documented between October 2025 and March 2026
— 9 legitimate RMM tools abused for persistent remote access
Middle East and Africa (primary), Europe (rapidly expanding since 2025), Global — confirmed operations across 14 regions, 113 countries
Targeted multiple organizations across the MENA region; first documented use of a Telegram bot as a C2 channel by MuddyWater. Attributed with high confidence by Group-IB.
Global targeting of international organizations using compromised legitimate accounts and NordVPN to obscure operator origins — first evidence of worldwide intelligence collection tasking.
Documented surge in MuddyWater infrastructure and targeting across Europe, marking the group's most significant geographic shift in operational history.
For years, MuddyWater operated with a tradecraft that bordered on predictable, following a recognizable pattern:
— Targeted spearphishing delivered through PDF attachments or links to legitimate file-sharing platforms.
— Heavy reliance on legitimate Remote Monitoring and Management (RMM) tools to establish the initial foothold.
— Hijacking legitimate mailboxes at the first compromised victim and re-launching phishing campaigns from those trusted accounts, weaponizing existing business relationships to reach the real target.
— Occasional deployment of custom malware where the off-the-shelf playbook alone would not suffice.
Across early 2026, MuddyWater has deliberately blurred the line between state-aligned espionage and commodity cybercrime, and the supporting evidence has accumulated at a remarkable pace.
— Custom malware development continues at a steady cadence — five new families have surfaced in early 2026 alone — and phishing remains the primary delivery mechanism. Recent research has even surfaced a bespoke tool the group uses to streamline phishing email distribution.
— RMM tools remain part of the kit, but their use has noticeably declined relative to previous years.
— A noticeable uptick has been observed in attacks against the network perimeter and public-facing systems of target organizations, including vulnerability exploitation attempts and password spraying.
— The group has openly adopted commodity malware into its operational portfolio, notably Chaos Ransomware-as-a-Service, the Tsundere Node.js botnet, and the Sliver C2 framework.
— Social engineering tradecraft has matured considerably — MuddyWater now leverages ClickFix, SEO poisoning via GitHub facades, and Microsoft Teams vishing.
— AI has been adopted into the operational toolkit, supporting various stages of the group's operations.
— Heavy reliance on PowerShell remains a defining signature, but it is increasingly wrapped in and delivered through Node.js, Deno, and Python loaders.
MuddyWater's persistence comes from constant retooling, which means defenders need threat intelligence that tracks how their TTPs evolve across campaigns, not just static IOCs. With adversary-centric attribution you can map each operational shift back to the group's infrastructure and tooling patterns, giving security teams the context to prioritize detections before the next wave of attacks hit.
not just spoofed addresses. MuddyWater sends phishing from legitimately compromised accounts; SPF/DKIM/DMARC alone will not catch it.
from unexpected geolocations — this is a documented MuddyWater operator access pattern.
accessed by non-standard processes — the CHAR backdoor uses Telegram bots as its C2 channel.
Infrastructure rotates frequently; point-in-time IOC lists lose value within days.
(AnyDesk, SimpleHelp, ScreenConnect, Action1, PDQ RMM) and alert on unauthorized installations or sessions originating from unusual network locations.
for priority techniques T1566 (spear-phishing), T1090 (proxy/VPN abuse), T1102 (web service C2), and T1204 (user execution via social engineering).
MuddyWater APT is an Iranian state-sponsored Advanced Persistent Threat group conducting cyberespionage and intelligence-gathering operations since 2017. It targets government, financial services, healthcare, logistics, science and engineering, and software sectors primarily across the Middle East and Africa, with a documented expansion into Europe since early 2025. The group is attributed to Iran’s Ministry of Intelligence and Security (MOIS) with high confidence by Group-IB.
Both are Iranian state-sponsored espionage groups, affiliated with MOIS. But they differ significantly in operational tempo and approach. MuddyWater is characterized by rapid toolkit rotation and broad phishing campaigns using compromised legitimate mailboxes, deploying at least three new malware variants between October 2025 and March 2026. OilRig tends toward more targeted and low profile intrusions with longer development cycles for bespoke implants, and more reliance on vulnerability exploitation. MuddyWater’s geographic reach is also notably broader, with confirmed activity across 113 countries.
MuddyWater sends phishing emails from legitimately compromised accounts rather than spoofed addresses. Because the emails originate from authenticated, trusted senders, they pass SPF, DKIM, and DMARC validation. Detection requires monitoring sender behavior anomalies — unusual login times, new client fingerprints, access from unexpected IP ranges — rather than relying on email header validation alone. They also employ good lures, which are often designed for their specific targets, in addition to using legitimate services and programs for initial infection.
Operation Olalampo is the most recent MuddyWater campaign documented by Group-IB, first observed on 26 January 2026 and attributed with high confidence. It targeted multiple organizations across the MENA region and introduced MuddyWater’s first documented use of a Telegram bot as a command-and-control channel — a significant tradecraft evolution. Group-IB’s monitoring of the Telegram C2 bot provided rare direct visibility into post-exploitation commands, deployed tools, and data collection techniques.
The order matters — preserve telemetry before you start cleaning up, because fragmented vendor telemetry is the threat actor’s defense and every additional data point materially helps the broader community.
Based on the trajectory observed by Group-IB, MuddyWater’s tradecraft is likely to evolve along several converging lines. The group will lean more heavily on AI-assisted malware development to produce variants that are harder to fingerprint with static signatures and that mutate quickly enough to outpace traditional detection cycles. At the same time, expect a commodity-crimeware overlay to become the default cover for state-aligned operations — using off-the-shelf RATs, loaders, and stealers (often the same toolkits sold on cybercrime forums) to blend espionage activity into the noise of ordinary financially motivated intrusions, making attribution slower and harder. Ransomware and destructive payloads deployed as decoys will grow more convincing, with proper ransom notes, working leak-site infrastructure, and plausible negotiation behavior, so that incident responders waste time treating an espionage breach as a criminal extortion event. Finally, abuse of signed binaries will expand, including misuse of legitimately signed tools from security vendors themselves — EDR components, remote management agents, and forensic utilities — to bypass trust-based controls and turn defenders’ own software supply chain against them.
