The Iranian state-sponsored threat actor known as MuddyWater has been attributed to a new swarm of attacks targeting Turkey and the Arabian Peninsula with the goal of deploying remote access trojans (RATs) on compromised systems.
“The MuddyWater supergroup is highly motivated and can use unauthorized access to conduct espionage, intellectual property theft, and deploy ransomware and destructive malware in an enterprise,” Cisco Talos researchers Asheer Malhotra, Vitor Ventura, and Arnaud Zobec said in a report published today.
The group, which has been active since at least 2017, is known for its attacks on various sectors that help further advance Iran’s geopolitical and national security objectives. In January 2022, the U.S. Cyber Command attributed the actor to the country’s Ministry of Intelligence and Security (MOIS).
MuddyWater is also believed to be a “conglomerate of multiple teams operating independently rather than a single threat actor group,” the cybersecurity firm added, making it an umbrella actor in the vein of Winnti, a China-based advanced persistent threat (APT).
