# Muddywater Mango Sandstorm

Adversary-emulation profile for MuddyWater (G0069 / Mercury / Mango Sandstorm / Static...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill muddywater-mango-sandstorm -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill muddywater-mango-sandstorm -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill muddywater-mango-sandstorm -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill muddywater-mango-sandstorm -g -a gemini-cli -y`

## Description

Adversary-emulation profile for MuddyWater (G0069 / Mercury / Mango Sandstorm / Static Kitten / TEMP.Zagros / Seedworm), Iran's MOIS cyber-espionage actor.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# MuddyWater (Mercury, Mango Sandstorm, Static Kitten, Seedworm, TEMP.Zagros), Adversary Emulation Profile

MuddyWater (MITRE ATT&CK **G0069**) is a cyber-espionage group assessed to be a subordinate element within Iran's **Ministry of Intelligence and Security (MOIS)**, active since at least 2017. The group has targeted government, telecommunications, defense, oil & gas, and IT organizations across the Middle East, Central/South Asia, Africa, Europe, and North America. MuddyWater is characterized by heavy reliance on **PowerShell-based backdoors** (POWERSTATS and its successors), **evolving custom C2 frameworks** (PhonyC2 → MuddyC2Go), **abuse of legitimate Remote Monitoring and Management (RMM) tools** (Atera, ScreenConnect, SimpleHelp), **spearphishing with macro-laden documents**, and a pragmatic blend of custom and open-source post-exploitation tooling. A February 2022 joint U.S./UK advisory (CISA AA22-055A) formally attributed the group to MOIS.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/muddywater/SKILL.md