TF-MAL-apk.mudwater
📛 Threat Title
Malware family: Mudwater
Description
ThreatFox malware family `apk.mudwater`. Printable name: Mudwater.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.mudwater
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.mudwater
IOC database
- Type
- domain
- Value
apk.mudwater- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.mudwater
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.mudwater
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). [1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE ...
-
web:cyberpress.org
MuddyWater's campaign in 2025 showcases a transition from generic remote monitoring and management tools to a fully custom multi-stage malware suite designed for stealth and resilience. Initial compromise begins with spear-phishing emails carrying malicious Office documents that, when opened, execute embedded VBA macros.
-
web:en.wikipedia.org
MuddyWater is an Iranian cyberespionage and advanced persistent threat (APT) group that is widely considered to be part of, or subordinate to, the Iranian Ministry of Intelligence and Security (MOIS). [1][2] First publicly identified in 2017, it has targeted government agencies, telecommunications operators, defense organizations, universities, oil and gas companies, across the Middle East ...
-
web:fieldeffect.com
MuddyWater is using a new Rust-based malware , RustyWater, delivered via malicious Word documents. Learn how to detect, mitigate, and reduce exposure.
-
web:securityaffairs.com
Iran-linked APT MuddyWater targeted U.S. organizations, deploying the new Dindoor backdoor across sectors including banks, airports, and nonprofits.
-
web:socradar.io
Researchers discovered that the attackers deployed a previously undocumented backdoor known as Dindoor, along with additional malware tools, to maintain access within victim networks. The campaign appears to have started in early 2026 and involved organizations such as a U.S. airport, a bank, a non-profit organization, and a software supplier connected to the defense and aerospace industry.
-
web:threatintelligence.garden.handsomezebra.com
Mudwater Description (Trend Micro) In addition to uncovering new campaigns, we were also able to find connections between MuddyWater and four Android malware variants that posed as legitimate applications.
-
web:www.cisa.gov
Description This Malware Analysis Report (MAR) is the result of analytic efforts by the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Cyber Command Cyber National Mission Force (CNMF), the United Kingdom's National Cyber Security Centre (NCSC-UK), and the National Security Agency (NSA) to provide detailed analysis of 23 files ...
-
web:www.group-ib.com
This blog post offers an in-depth insight about MuddyWater, an Iranian state-sponsored APT group. It examines their recent tools and malware , network infrastructure, and changes in operational activity observed since early 2025.
-
web:www.rescana.com
The Iranian state-sponsored advanced persistent threat group MuddyWater (also tracked as Mango Sandstorm, TA450, Seedworm, and G0069) has escalated its cyber-espionage operations in early 2026, deploying a sophisticated new malware family as geopolitical tensions in the Middle East intensify. The latest campaign is characterized by the use of a Rust-based remote access trojan, RustyWater ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.