Muddywater Mango Sandstorm
Adversary-emulation profile for MuddyWater (G0069 / Mercury / Mango Sandstorm / Static...
Install
npx skills add BitterSecurity/Decepticon --skill muddywater-mango-sandstorm -g -a claude-code -y- Repository
- BitterSecurity/Decepticon6.5k
- Category
- Engineering
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Adversary-emulation profile for MuddyWater (G0069 / Mercury / Mango Sandstorm / Static Kitten / TEMP.Zagros / Seedworm), Iran's MOIS cyber-espionage actor.
MuddyWater (Mercury, Mango Sandstorm, Static Kitten, Seedworm, TEMP.Zagros), Adversary Emulation Profile
MuddyWater (MITRE ATT&CK G0069) is a cyber-espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS), active since at least 2017. The group has targeted government, telecommunications, defense, oil & gas, and IT organizations across the Middle East, Central/South Asia, Africa, Europe, and North America. MuddyWater is characterized by heavy reliance on PowerShell-based backdoors (POWERSTATS and its successors), evolving custom C2 frameworks (PhonyC2 → MuddyC2Go), abuse of legitimate Remote Monitoring and Management (RMM) tools (Atera, ScreenConnect, SimpleHelp), spearphishing with macro-laden documents, and a pragmatic blend of custom and open-source post-exploitation tooling. A February 2022 joint U.S./UK advisory (CISA AA22-055A) formally attributed the group to MOIS.
