Skip to content

CyberSIXT Search

Threat actor · coverage timeline

MuddyWater

24 articles from 9 outlets between 17 Sep 2025 and 24 Jun. First reported by GBHackers. The busiest day was Fri 6 Mar, with 4 articles.

Articles: 24; all time · from 9 outlets
Days with coverage: 16; across 281 days
Busiest day: 4; articles on Fri 6 Mar
Last 7 days: 0a day; vs 0.1 a day before
First report: 17 Sep 2025; GBHackers
CVEs named: 0; in these articles

Coverage over time

24 articles · 17 Sep 2025 – 24 Jun

17 Sep 2025First report17 Sep 2025 · GBHackers

Show as table

MuddyWater: articles per day
Day (UTC)	Articles	Outlets
Wed 17 Sep 2025	1	GBHackers 1
Fri 19 Sep 2025	1	SecurityOnline 1
Wed 22 Oct 2025	1	The Hacker News 1
Thu 23 Oct 2025	2	SecurityOnline 1, GBHackers 1
Tue 28 Oct 2025	1	GBHackers 1
Tue 2 Dec 2025	1	Dark Reading 1
Thu 4 Dec 2025	1	Dark Reading 1
Mon 8 Dec 2025	2	SecurityOnline 1, The Hacker News 1
Sat 10 Jan	1	The Hacker News 1
Mon 23 Feb	2	The Hacker News 1, Dark Reading 1
Fri 6 Mar	4	The Hacker News 1, SecurityWeek 1, Infosecurity 1, Security Affairs 1
Mon 9 Mar	1	SOCRadar 1
Tue 31 Mar	1	Ars Technica 1
Wed 6 May	3	SecurityWeek 1, The Hacker News 1, Security Affairs 1
Tue 26 May	1	The Hacker News 1
Wed 24 Jun	1	Infosecurity 1

Articles

24 articles

Wed 24 Jun1 article

12:20
Iranian MuddyWater disguises espionage as ransomware attacksInfosecurity

Tue 26 May1 article

16:51
MuddyWater Uses DLL Side Loading in Nine Nation EspionageThe Hacker News

Wed 6 May3 articles

15:21
Iranian spies fake Chaos ransomware to steal data via TeamsSecurity Affairs
14:46
MuddyWater hijacks Teams to spread Chaos ransomware false flagThe Hacker News
13:32
Iran-linked MuddyWater fakes Chaos ransomware in 2026 breachSecurityWeek

Tue 31 Mar1 article

14:00
Iran's hackers are on the offensive against the US and IsraelArs Technica

Mon 9 Mar1 article

09:45
Iranian MuddyWater Deploys Dindoor Backdoor Through Deno RuntimeSOCRadar

Fri 6 Mar4 articles

20:42
Iran-linked MuddyWater Unveils Dindoor Backdoor via DenoSecurity Affairs
15:34
MuddyWater hits firms with Dindoor backdoor; Fakeset linkedInfosecurity
12:00
MuddyWater uses Dindoor and Fakeset backdoors in US networksSecurityWeek
11:29
MuddyWater hits US banks with Dindoor backdoor via Deno runtimeThe Hacker News

Mon 23 Feb2 articles

21:31
Iran linked MuddyWater turns to AI and Telegram C2 targeting MENADark Reading
08:11
Iranian MuddyWater uses AI built Rust backdoor to hit MENA targetsThe Hacker News

Sat 10 Jan1 article

11:21
MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East SectorsThe Hacker News

Mon 8 Dec 2025 20252 articles

07:25
MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan CampaignThe Hacker News
02:35
Iran-Linked MuddyWater Deploys UDPGangster Backdoor, Using UDP Protocol for Covert C2SecurityOnline

Thu 4 Dec 2025 20251 article

07:35
'MuddyWater' Hackers Target Israeli Orgs With Retro Game TacticDark Reading

Tue 2 Dec 2025 20251 article

22:30
Iran's 'MuddyWater' Levels Up With MuddyViper BackdoorDark Reading

Tue 28 Oct 2025 20251 article

12:50
MuddyWater’s Phoenix Backdoor Infects More Than 100 Government OrganizationsGBHackers

Thu 23 Oct 2025 20252 articles

07:17
New Malware Toolkit from MuddyWater Delivers Phoenix Backdoor to Global TargetsGBHackers
01:41
Iran-Linked MuddyWater Deploys Phoenix v4 Backdoor via Compromised Emails and NordVPN Exit NodeSecurityOnline

Wed 22 Oct 2025 20251 article

18:05
Iran-Linked MuddyWater Targets 100+ Organisations in Global Espionage CampaignThe Hacker News

Fri 19 Sep 2025 20251 article

01:45
MuddyWater APT Shifts Tactics to Custom MalwareSecurityOnline

Wed 17 Sep 2025 20251 article

13:56
MuddyWater Deploys Custom Multi-Stage Malware Hidden Behind CloudflareGBHackers · first report