MuddyWater, an Iranian state-sponsored threat actor, has initiated a spear-phishing campaign against Israeli targets utilizing a tool from N-able, the legitimate administration tool for remote access known as Advanced Monitoring Agent. This marks a shift in the tactics, techniques, and procedures (TTPs) used by MuddyWater (Mango Sandstorm, Static Kitten), but reflects a consistent strategy in their operations. Researchers from multiple cybersecurity firms reported on the campaign, describing a new file-sharing service used for executing multi-stage attacks. These attacks involve sending emails with malicious attachments to deploy remote administration tools, enabling the attackers to perform network reconnaissance. MuddyWater has also developed a new command-and-control (C2) framework known as MuddyC2Go. MuddyWater, active since 2017 and a vital part of Iran’s Ministry of Intelligence and Security, continues to evolve its methods while using similar modes of operation with a history of success. The latest incidents feature the use of legitimate remote administration software and sophisticated infection techniques, underlining the growing risk posed by the threat actors and the broader advancements in Iran’s cyber threat capabilities.