Tactics, Techniques & Procedures (TTPs): MuddyWater utilizes custom PowerShell backdoors, legitimate remote monitoring and management (RMM) tools, and sophisticated social engineering to gain initial access. They are known for their 'living off the land' (LotL) techniques to evade detection.

MuddyWater is a prolific threat actor linked to Iran's Ministry of Intelligence and Security (MOIS). Their recent campaign against South Korean electronics makers indicates a broadening of their mission from regional political espionage to global industrial theft. They often use compromised legitimate accounts to send phishing emails, making their initial entry difficult to distinguish from normal business communications. Once inside, they deploy tools like 'MuddyC3' and 'Static Kitten' to maintain persistence and exfiltrate data.