Iranian linked conglomerate Muddy Water comprised of regionally focused subgroups
Summary: Cisco Talos reported new MuddyWater campaigns using malicious Excel documents to deliver a Windows script file-based remote access trojan it calls SloughRAT, which CISA's February 2022 alert refers to as "canopy". Talos said the group's varied lures, payloads and regional targeting support its hypothesis that MuddyWater is a conglomerate of sub-groups, each focused on a specific geography, sharing techniques that align with Iranian national security objectives including espionage, intellectual theft and disruptive operations.
Key Takeaway: U.S. Cyber Command has attributed MuddyWater to Iran's Ministry of Intelligence and Security, and Talos ties the same shared tooling and watermarks to Phosphorus, which is attributed to the IRGC - meaning techniques tested against one region's government, telecom or university targets are reused against the next.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026