Recent activity from the DEV-1084 threat group has shown some increased attribution to the Iranian nation-state threat group MuddyWater. DEV-1084 is believed to be a small threat organization working in tandem with MuddyWater, responsible for the post-breach destruction of victim networks and infrastructure. MuddyWater is a well-known threat group responsible for numerous cyberespionage attacks against government entities and critical infrastructure organizations throughout the United States, Southern Asia, and the Middle East. Threat actors from the group operate on the sole mission of gathering intelligence to benefit the Iranian state. Recent intelligence gathered by Microsoft shows that MuddyWater actors would exploit their target victim(s) and DEV-1084 would begin the invasive and crippling attacks on the victim’s networks. DEV-1084 utilizes compromised administrative credentials to gain privileges within the environment, allowing for the encryption and exfiltration of company documents, storage, virtual machines/networks, cloud resources, and employee email inboxes. The connections showing relations between DEV-1084 and MuddyWater are a hosting IP address and domain name used by MuddyWater in past attacks, alongside usage of the MULLVAD VPN, Rport, and Ligolo custom scripts utilized by the group. MuddyWater continues to be a major player throughout the threat landscape and is believed to be comprised of several sub-groups, each focusing on a different aspect of the MuddyWater mission. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.