Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionage
IranThreat Actor
Active Threat
MuddyWater
104
IOCs Tracked
14
Intel Reports
Associated IOCs50 total
Domain1
t2.net2026-07-24High
URL48
http://facebook-photo5.blogspot.com/2026-09-15High
http://sp25ct7-zervax-biz-kersen-famdok.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://www.saskaccessaccountservicedeskuser202.vercel.app/2026-07-24High
http://zwurd-bfrnk-skrunt-0rw71c-vznk-prentz.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://sp3ct-vornak-biz8-seltri-qovan.pages.dev/appeals/submit-appeal-form/return2026-07-24High
https://www.trust-ledger-login-patch-gateway.vercel.app/2026-07-24High
https://yhnuj0fdran-xjnshlpw-0a3b6c-xj811a.pages.dev/2026-07-24High
http://sp29ct-fervik-biz-kantor-hazsel.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://duishalik.blogspot.com/2026-07-24High
http://sp3ct-lodvek-biz8-karsin-zumel.pages.dev/appeals/submit-appeal-form/return2026-07-24High
https://2farobux.com/redeem/ctbSex5crcuN2026-07-24High
http://saabeqoon.com/js/vendor/update2026-07-24High
https://www.instagramloginpage111.blogspot.com/2026-07-24High
http://www.netflixfree2024.blogspot.com/2026-07-24High
https://ipfs.io/ipfs/bafybeifkilhlranv7rj63emeaaz3gye5rigd72s2cpuo4chpfvwqqp3sie2026-07-24High
https://ledger-wallets-auth-graphical.vercel.app/ledger%20form/index.html/2026-07-24High
http://sp29ct-vaztor-biz-hemqik-forsel.pages.dev/appeals/submit-appeal-form/return2026-07-24High
https://www.meta-maskluginxgic.godaddysites.com/2026-07-24High
https://net-ledger-wallet-data-script.vercel.app/ledger%20form/index.html/2026-07-24High
http://thecourierdelivery2.netlify.app/2026-07-24High
http://leboncoin1.github.io/leboncoin2026-07-24High
https://maisixx.us.cc/5g2026-07-24High
http://ui-clone-by-naman.netlify.app/2026-07-24High
http://twxpl54lkwg-bgrnd65spli-2ce31c-zby5k.pages.dev/appeals/submit-appeal-form/return2026-07-24High
https://facebooklogincomin.blogspot.com/?m=12026-07-24High
http://sp29ct-hemtor-biz-zanrik-vaskel.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://sp25ct7-qorvok-biz-hemlor-fansik.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://sp3ct-voslar-biz8-tenvik-qurem.pages.dev/appeals/submit-appeal-form/return2026-07-24High
https://www.net-ledger-wallet-data-ios.vercel.app/2026-07-24High
http://sp25ct7-vernax-biz-kalsor-femlin.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://sp3ct-drenix-biz8-solvek-tranu.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://imountsecurity.co.nz/hansonagy/2026-07-24High
http://sp29ct-meltor-biz-zovrik-kansel.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://sp3ct-baslor-biz8-qurvik-fonel.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://sp29ct-pralvik-biz-komtor-zefsel.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://zwurd-vlypx-skrunt-0rw71c-zplv-prentz.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://fracturdevisdokd.duckdns.org/2026-07-24High
http://sp3ct-wesnar-biz8-polvik-damel.pages.dev/appeals/submit-appeal-form/return2026-07-24High
https://www.trust-ledger-login-patch-testing.vercel.app/2026-07-24High
http://sp29ct-horlen-biz-pravok-kemvik.pages.dev/appeals/submit-appeal-form/return2026-07-24High
https://www.netflix-clone-nextjs.vercel.app/2026-07-24High
https://www.wallet-trezor-login-trust-website.vercel.app/2026-07-24High
http://ksaservicesarl.com/visionrealtymgt/2026-07-24High
https://135461223.site/1781/565c2b3b-b892-4792-8858-fe75524f363a/7504312026-07-24High
http://sp25ct7-forvex-biz-kamlor-felsik.pages.dev/appeals/submit-appeal-form/return2026-07-24High
http://www.bankofamerica-mi.vercel.app/2026-07-24High
http://lh.gecnnrl.com/NeemaHospitalityManagement/2026-07-24High
https://www.acreditar.webcindario.com/2026-07-24High
CVE1
CVE-2026-330172026-08-22High
Related Reports14 total
SimpleHarm: Tracking MuddyWater’s infrastructure
Group-IB
Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025
Group-IB
Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage
Group-IB
Operation Olalampo: Inside MuddyWater’s Latest Campaign
Group-IB
Catching fish in muddy waters
Group-IB
MuddyWater-Linked Dindoor Backdoor Abuses Legitimate Deno Runtime to Evade Detection
Cyber PressAug 26, 2026
Cyber Conflict Briefing Q2 2026
DCSO CyTec BlogAug 3, 2026
OpenPhish (300 entries)
OpenPhish
Weekly Threat Landscape Digest – Week 28
HawkEyeJul 10, 2026
May 2026 Threat Trend Report on APT Groups
AhnLabJun 15, 2026
Critical Langflow Vulnerability Exploited for Malicious Code Execution
Cyber PressJun 11, 2026
When Your AI Agent’s Memory Becomes a Security Liability
Check Point BlogJun 11, 2026
Exposing Fox Tempest: A malware-signing service operation
Microsoft Threat IntelligenceMay 19, 2026
NSFOCUS Monthly APT Insights – March 2026
NSFOCUS Security LabsMay 28, 2026
Threat Profile
Motivationespionage
Origin
Iran
Last seenSep 2026
IOCs tracked104