Cataloged
IdentityAlias: Earth Vetala
Reviewed identity mapping approved on this date.
MuddyWater
Also known as Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill
Tracked as
G0069
MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityAlias: MERCURY
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Static Kitten
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Seedworm
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: TEMP.Zagros
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Mango Sandstorm
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: TA450
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: MuddyKrill
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G0069
Reviewed identity mapping approved on this date.
Cataloged
CVECVE-2020-0688 linked to this actor
Cataloged
CVECVE-2018-13379 linked to this actor
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
MuddyWaterCanonical Name
Earth VetalaAlias
MERCURYAlias
Mango SandstormAlias
MuddyKrillAlias
SeedwormAlias
Static KittenAlias
TA450Alias
TEMP.ZagrosAlias
G0069Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...