MuddyWater operates under Iran's Ministry of Intelligence and Security (MOIS), not the IRGC. This is a different chain of command from APT35 and APT42 (both IRGC). MOIS handles domestic security and foreign intelligence collection. MuddyWater's targeting reflects this: government agencies, telecom providers, energy companies, and defense organizations, primarily in the Middle East but extending into Europe, North America, and South Asia.

MuddyWater is not sophisticated. They don't build elaborate social engineering campaigns like APT35 or deploy mobile spyware like APT42. They send spearphishing emails with malicious attachments (OneNote, PDF, archive lures), compromise the endpoint, and establish PowerShell-based C2 for data collection. Their value to MOIS is volume and persistence, not stealth. They cast a wider net and accept a higher detection rate.

MuddyWater's signature is their heavy reliance on PowerShell at every stage of the intrusion. Their custom C2 framework (MuddyC2Go, successor to MuddyC3 and PhonyC2) is PowerShell-based. Their reverse shells are PowerShell. Their data collection scripts are PowerShell. Their persistence mechanisms use PowerShell. If you have PowerShell ScriptBlock logging (EID 4104) enabled, MuddyWater's entire operation is visible in your logs.

Legitimate tool abuse. MuddyWater increasingly deploys legitimate RMM tools (Atera, SimpleHelp, ScreenConnect) alongside or instead of custom C2. This mirrors the Scattered Spider RMM abuse pattern. The RMM tool provides persistent remote access that blends with IT management traffic and doesn't trigger malware detections.

1. 1. Search for encoded PowerShell execution MuddyWater's signature: PowerShell with -EncodedCommand or -e flag executing base64 payloads. Search Sysmon EID 1 for powershell.exe with -e or -enc in the command line. ScriptBlock logging (EID 4104) captures the decoded content. If you have 4104 enabled, search for: Invoke-WebRequest, Invoke-Expression, Net.WebClient, DownloadString, and encoded reverse shell patterns. HOST: Execution · Sysmon EID 1 · PowerShell EID 4104
2. 2. Check for maldoc delivery via email Search email gateway logs for: OneNote attachments (.one) with embedded scripts, PDF attachments with links to external download sites, RAR/ZIP archives containing LNK files, and macro-enabled Office documents. MuddyWater's lures are themed around government communications, official documents, HR notices, and telecom industry topics. Email gateway: attachment type analysis · Sandbox detonation results
3. 3. Hunt for MuddyC2Go beacon traffic MuddyC2Go communicates via HTTP POST requests to cloud-hosted infrastructure. The beacon sends encoded system information (hostname, IP, OS version, username) on first callback and polls for commands. Search proxy logs for: regular-interval HTTP POST requests to cloud hosting providers (AWS, Azure, DigitalOcean, free hosting platforms) from non-browser processes. NET: C2 · Proxy logs: POST requests from PowerShell processes
4. 4. Check for unauthorized RMM tools MuddyWater deploys Atera, SimpleHelp, and ScreenConnect for persistence. Search for: RMM agent installation events, RMM binary execution from non-standard paths, and RMM cloud service connections from hosts that aren't managed by your IT team's approved RMM platform. Sysmon EID 1: RMM binary names · EID 3: connections to RMM cloud infrastructure
5. 5. Check for lateral movement via WMI and RDP Post-compromise, MuddyWater uses WMI for remote command execution and RDP for interactive access. Search for: WmiPrvSE.exe spawning cmd.exe or PowerShell (remote WMI execution), type 10 logons (RDP) from internal hosts that don't normally initiate RDP, and credential use from accounts that don't normally access the target systems. HOST: T1047 WMI · T1021.001 RDP · EID 4624 type 10
6. 6. Search for data staging and exfiltration MuddyWater uses PowerShell scripts to collect documents and stage them for exfiltration. Search for: PowerShell Compress-Archive commands creating ZIP files, large file copies to staging directories, and outbound uploads to cloud storage or C2 infrastructure. The exfiltration often uses the same C2 channel as the beacon traffic. NET: Exfiltration · Data Exfil playbook

MOIS, not IRGC. Different chain of command, different intelligence priorities, different targeting. MuddyWater targets government and infrastructure. APT35/42 targets individuals and political organizations. Both are Iranian state-sponsored, but they report to different agencies.

Volume over stealth. MuddyWater runs broad phishing campaigns against many organizations simultaneously. They accept that some will be detected. Their model is: send enough lures to enough targets that some percentage will succeed. This is the opposite of APT42's one-target-at-a-time patience.

PowerShell-native. If the entire intrusion is PowerShell from initial execution through C2 through data collection, and the targeting is government/telecom/energy in the Middle East or Europe, it's probably MuddyWater. No other Iranian group is this committed to PowerShell as a platform.

APT35 / Charming Kitten (IRGC, credential-focused, different agency)
APT42 (IRGC-IO, individual surveillance, different mandate)
Compromised Credentials (MuddyWater harvests creds post-compromise)
C2 Beacon Found (MuddyC2Go detection)