The United States Cyber Command (USCYBERCOM) has officially linked the widely known MuddyWater threat group to the Iran Ministry of Intelligence & Security (MOIS). MOIS it’s the top intelligence agency in Iran, primarily focusing on domestic intelligence and counterintelligence, alongside covert operations supporting the Islamic agenda. MuddyWater (also known SeedWorm and Zagros) was originally discovered back in 2017, focusing on targeting Middle Eastern entities in the telecommunication, government, IT services, and oil industry sectors while continuing to test and update their cyberespionage arsenal from these attacks. Several malware samples have already been discovered and analyzed for threat actor indicators of compromise, tactics, and techniques of attack, with variants relating to the “PowGoop” malware; a malicious DLL loader designed to execute a PowerShell-based malware downloader. Another significant tool tied to MuddyWater is the “Mori” backdoor, used in tandem with PowGoop and DNS tunneling communications during cyberespionage operations conducted by the group. CTIX is continuing to monitor activity surrounding this threat group and will provide updates as needed.