Not every telecom-targeting APT needs a zero-day. Since 2017, an Iranian Ministry of Intelligence and Security (MOIS)-linked group tracked by Microsoft as MERCURY and by CrowdStrike as Static Kitten has run a continuous espionage campaign against telecom, government, and defense targets across the Middle East, Asia, Africa, and Europe — using little more than a convincing email, a patched-but-not-really VPN appliance, and legitimate remote-access software the target's own help desk might use. MITRE tracks the group as G0069: MuddyWater.
There is no CVE headline here. No signaling protocol exploited, no core network function poisoned. MuddyWater's entire operating model is proof that a telecom operator's management plane — the VPN concentrators, the email gateway, the OSS/BSS access paths from enterprise IT — is target enough. Nine years on, the group remains active, and its persistence is the story: an actor that doesn't need to be sophisticated when the fundamentals (patching, email filtering, access segregation) keep being left undone.
This article traces MuddyWater's attribution and timeline, its entry vectors, a phase-by-phase kill chain reconstruction, its toolset, and the ATT&CK-mapped techniques defenders should be hunting for. For the broader lifecycle this campaign fits into, see our telecom penetration testing methodology.
MuddyWater is a Middle-East-focused, management-plane espionage actor active since 2017 and still operating as of 2024. It relies on spearphishing with malicious documents and exploitation of internet-facing Fortinet and Log4Shell-vulnerable appliances for initial access, then moves laterally through enterprise IT into telecom OSS/BSS environments using living-off-the-land tooling and commercial remote-access software.
I. Attribution and Timeline
MuddyWater (MITRE ATT&CK G0069) is attributed to Iran's Ministry of Intelligence and Security (MOIS). Microsoft's threat intelligence center tracks the group as MERCURY; CrowdStrike labels it Static Kitten. The naming spread reflects nearly a decade of independent tracking across multiple vendors before consensus attribution solidified.
| Field | Detail |
|---|---|
| Origin | Iran — MOIS (Ministry of Intelligence and Security) |
| Classification | Middle-East telecom espionage APT |
| Plane targeted | Management plane |
| First seen | 2017 |
| Publicly disclosed | 2017 |
| Dwell time | Ongoing — active as of 2024 |
| Targets | Telecoms, government, defense across Middle East, Asia, Africa, Europe |
| Threat level | HIGH |
Unlike the Chinese-nexus actors profiled in our adversary registry — Salt Typhoon on the management plane or Liminal Panda on SS7/Diameter — MuddyWater's mission is narrowly geopolitical. Iran's intelligence apparatus uses telecom compromise as a means to an end: subscriber data and VPN access that support broader surveillance of government, defense, and dissident targets across the region, not mass signaling interception or financial fraud.
The dwell characterization — "ongoing, active as of 2024" — is itself notable. Most APT profiles get written after a campaign is contained. MuddyWater has been publicly attributed, sanctioned in some jurisdictions, and repeatedly called out in joint advisories, and it is still operating. That persistence despite public exposure says something about the cost-benefit calculus of low-sophistication, high-volume espionage: burning one phishing infrastructure cluster is cheap when the next one costs an afternoon to stand up.
II. Entry Vectors: Phishing and the Patch Gap
MuddyWater's initial access strategy rests on two pillars, and neither requires telecom-specific expertise.
Spearphishing with malicious documents. The group's signature move is a targeted email carrying a weaponized Office document — typically a macro-laden file that, once enabled, drops or downloads the next-stage loader. Targeting is selective: government and telecom personnel with plausible pretexts related to their role, not mass untargeted spam.
Exploitation of internet-facing infrastructure. Where phishing doesn't land, MuddyWater has been observed exploiting known vulnerabilities in Fortinet appliances and Log4Shell (CVE-2021-44228)-affected services exposed to the internet. Both are years-old, well-documented vulnerability classes — the entry vector isn't novel discovery, it's exploiting operators who haven't patched perimeter infrastructure on a reasonable cadence.
Once inside, MuddyWater doesn't pivot through signaling infrastructure the way an SS7-specialist actor would. Its movement layer is enterprise IT lateral movement into telecom OSS/BSS systems — the billing, provisioning, and subscriber-management systems that sit adjacent to, but outside, the core signaling network. That's a meaningful distinction for defenders: the controls that matter here are identity and access management on enterprise IT, not signaling firewalls.
III. Kill Chain Walkthrough
Reconstructing the MuddyWater kill chain against telecom targets phase by phase, mapped to the Lockheed Martin model and cross-referenced against ATT&CK technique IDs:
Reconnaissance. MuddyWater performs reconnaissance of Middle East telecom operators, identifying management interfaces and VPN endpoints exposed to the internet (T1190 — Exploit Public-Facing Application, at the discovery stage). This is largely passive footprinting: scanning for known-vulnerable Fortinet software versions and Log4Shell-exposed services before any active exploitation begins.
Delivery. Two parallel delivery paths: spearphishing campaigns carrying malicious macro documents, and direct exploitation of Fortinet or Log4Shell vulnerabilities on internet-facing appliances (T1566 — Phishing, T1190 — Exploit Public-Facing Application). Both paths converge on the same objective — code execution on a host inside the target's network perimeter.
Exploitation. Once a foothold lands, execution proceeds via PowerShell-based tooling — specifically the PowGoop loader — and credential theft through remote service abuse (T1059 — Command and Scripting Interpreter, T1021 — Remote Services). This is where the actor moves from "got a shell" to "can reach adjacent systems."
Installation. Persistence is established using SimpleHelp (a legitimate commercial remote-support tool repurposed as a backdoor) or Ligolo-ng for tunneled access, combined with reuse of valid VPN accounts obtained during exploitation (T1078 — Valid Accounts, T1572 — Protocol Tunneling). Using legitimate remote-support software is a deliberate defense-evasion choice: SimpleHelp traffic looks like an IT admin doing IT admin things, not malware calling home.
Actions on Objectives. Collection focuses on subscriber PII, credential exfiltration, and geopolitical intelligence gathering on government subscribers accessible through the compromised telecom environment (T1213 — Data from Information Repositories). This is the payoff phase that explains the whole campaign's purpose: not disruption, not fraud, but sustained intelligence collection on people of interest to the Iranian state.
IV. The Toolset
MuddyWater's kit is small, reusable across campaigns, and deliberately unremarkable:
| Tool | Role |
|---|---|
| PowGoop | PowerShell-based loader; typically delivered via DLL side-loading, used for execution and staging further payloads |
| Sluware | Component of the group's execution/obfuscation toolkit associated with MuddyWater intrusion sets |
| Canopy | Backdoor/downloader tooling used in the group's persistence chain |
| SimpleHelp | Legitimate commercial remote-support software, repurposed as a covert remote-access channel that blends with normal IT admin traffic |
| Ligolo-ng | Open-source, Go-based reverse tunneling tool used to pivot traffic through compromised hosts and maintain covert C2 |
None of these tools are telecom-specific. That's consistent with the group's overall profile: MuddyWater is an enterprise-IT-first actor whose targets happen to include telecom operators, not a signaling-protocol specialist. Compare that to actors like Liminal Panda or LightBasin, whose entire toolkits are built around SS7 and GTP protocol internals.
V. ATT&CK Technique Mapping
| Technique ID | Name | Tactic |
|---|---|---|
| T1566 | Phishing | Initial Access |
| T1190 | Exploit Public-Facing Application | Initial Access |
| T1059 | Command and Scripting Interpreter | Execution |
| T1021 | Remote Services | Lateral Movement |
| T1078 | Valid Accounts | Persistence |
| T1572 | Protocol Tunneling | Command and Control |
| T1213 | Data from Information Repositories | Collection |
This is a compact, almost minimalist technique set compared to management-plane actors like Salt Typhoon or GALLIUM, which routinely chain a dozen-plus techniques through Active Directory and CALEA-adjacent systems. MuddyWater's smaller footprint is a feature of its mission profile: sustained, low-noise access for intelligence collection rather than mass data harvest or infrastructure pre-positioning.
VI. The Standards Gap
MuddyWater's continued operational success — nine years and counting — maps directly to three control gaps that are organizational rather than technical-protocol failures:
- Management access controls. VPN and remote-access credentials, once obtained through phishing or appliance exploitation, provide durable lateral movement into telecom OSS/BSS. Segregating management-plane access from general enterprise IT credentials would break this chain at the persistence stage.
- Email gateway filtering. Macro-document phishing remains effective because attachment filtering, macro execution policy, and sender authentication (DMARC/DKIM/SPF enforcement) are inconsistently applied across the target regions MuddyWater operates in.
- VPN and edge appliance patching. Fortinet and Log4Shell exploitation both depend on operators running vulnerable software past the point where patches were available. This is the same patch-cadence gap that enabled Salt Typhoon's Cisco IOS-XE compromise and Volt Typhoon's Fortinet-based pre-positioning — a recurring theme across nation-state telecom campaigns regardless of origin.
None of these require new standards to be written. GSMA and 3GPP guidance on management-plane segregation already exists; the gap is enforcement and patch discipline, not a missing specification.
VII. Authoritative References
- 01 CISA AdvisoryIranian Government-Sponsored APT Actors Conduct Cyber Espionage Against Global Government and Commercial Networks (MuddyWater) Feb 2022
- 02 Microsoft MSTICMERCURY (MuddyWater) Threat Intelligence Update 2022
- 03 MITRE ATT&CKG0069 — MuddyWater Group ProfileMITRE ATT&CK G0069 →
VIII. Frequently Asked Questions
Yes. MuddyWater is the MITRE ATT&CK designation (G0069) for this Iranian MOIS-linked group. Microsoft's threat intelligence center tracks the same activity cluster as MERCURY, and CrowdStrike labels it Static Kitten. The naming divergence reflects independent vendor tracking of overlapping infrastructure and tradecraft before formal attribution consensus formed — a common pattern with long-running APT groups.
No. MuddyWater's entry and movement is entirely enterprise-IT-centric — spearphishing, Fortinet/Log4Shell exploitation, and lateral movement into telecom OSS/BSS systems. It does not target signaling protocols like SS7 or Diameter, nor 5G Service Based Architecture APIs. This distinguishes it from telecom-protocol specialists like Liminal Panda or LightBasin.
Legitimate remote-support tools generate traffic patterns that look identical to an organization's own IT help desk activity, making them far less likely to trigger signature-based malware detection. Custom implants carry unique signatures that mature EDR products eventually catch; a SimpleHelp session blends into the noise of routine administrative access.
Reporting indicates the group collects credentials, VPN access, subscriber data, and geopolitical intelligence — particularly intelligence on government and defense-affiliated subscribers reachable through compromised telecom environments. This is consistent with a state intelligence mission focused on surveillance of specific individuals rather than bulk data harvesting or financial fraud.
MuddyWater was first observed in 2017 and, per CISA and Microsoft reporting, remained active as of 2024 — nearly nine years of continuous operation. Public attribution and multiple joint advisories have not halted the campaign, underscoring that low-sophistication, high-persistence tradecraft can remain viable indefinitely against under-hardened targets.
Mandatory MFA and conditional access enforcement on VPN and remote-access infrastructure would break the group's core persistence model, which depends on reusing valid stolen credentials. Combined with strict macro-execution policy on email attachments and a sub-14-day patch SLA for internet-facing Fortinet/VPN appliances, these three controls address MuddyWater's entire observed entry-to-persistence chain.
Conclusion & Next Steps
MuddyWater is a reminder that not every telecom-targeting APT needs protocol-level sophistication to sustain nearly a decade of espionage access. Spearphishing, unpatched edge appliances, and legitimate remote-access tooling — deployed patiently and repeated after every takedown — have proven durable against operators across the Middle East, Asia, Africa, and Europe.
Recommended priorities for operators assessing exposure to this actor:
- Immediate: Enforce MFA on all VPN/remote-access infrastructure; audit for SimpleHelp or unexplained remote-support sessions
- Short-term: Tighten email gateway macro-execution policy and sender authentication (DMARC/DKIM/SPF)
- Medium-term: Establish a sub-14-day patch SLA for internet-facing Fortinet and other VPN/edge appliances
- Ongoing: Segregate management-plane credentials from general enterprise IT identity, and monitor for anomalous use of legitimate admin tooling
For the broader methodology used to assess exposure to management-plane and enterprise-pivot actors like MuddyWater, see our telecom penetration testing lifecycle.
