Threat actors associated with the MuddyWater threat organization have been observed enhancing their malware arsenal, improving, and upgrading their tactics to become more destructive than previous operations. MuddyWater is commonly known for its extensive cyber espionage campaigns throughout the Middle Eastern regions, which have seen targeted activity since the groups birth in 2017. Associated with Iran’s Ministry of Intelligence & Security, MuddyWater’s victims tend to fall within telecommunications, government, and industrial sectors. Improvements made to the organizations tactics include a new mainstage downloader PowGoop, masked command-and-control communications from DLL files and Telegram API endpoints, variants of the Starwhale/Canopy malware to transmit data, and the addition of two backdoors Mori and Powerstats which enable system persistence. CTIX analysts will continue to monitor for any additional activity surrounding MuddyWater and numerous other actors and provide updates accordingly.