Iranian APT Muddy Water targets Turkish users via malicious PDFs, executables
Summary: Cisco Talos observed a MuddyWater campaign targeting Turkish private organizations and government entities, including the Scientific and Technological Research Council of Turkey (Tubitak), using malicious PDFs that link to XLS maldocs or Windows executables hosted on a file-sharing domain, snapfile[.]org. The maldocs, some named to impersonate documents from the Turkish Health and Interior Ministries, deploy VBS and PowerShell scripts, set persistence through an HKCU Registry Run key, and in later versions call canarytokens.com, which Talos assesses as anti-analysis. MuddyWater, also known as MERCURY or Static Kitten, was attributed to Iran's Ministry of Intelligence and Security by U.S. Cyber Command and has been active since at least 2017.
Why it matters: The group's use of canary tokens and a 40-second, twice-retried download timeout shows the operators checking whether analysis is underway before delivering the final payload, which Talos could not obtain. A spear-phishing lure that mimics a health or interior ministry document is the kind of email your users are trained to trust.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026