MuddyWater

MuddyWater is a cyber espionage group associated with Iran's Ministry of Intelligence and Security (MOIS). Active since at least 2017, it has targeted government and private organizations across multiple sectors in the Middle East, Asia, Africa, Europe, and North America. The group has reused domains since October 2025 and has used commercial satellite internet, such as Starlink, for command and control communications.