Threat actor

MuddyWater

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 18, 2026 · last 7d ago

Timeline2 articles

Iranian APTs increased activity against US industries in late spring, researchers say

Nozomi Networks recorded 28 Iran-linked attacks on US customers in May-June, up 133%, mostly hitting transportation and manufacturing.

Nozomi Networks telemetry showed 28 Iran-linked attacks against customers in May and June versus 12 in the prior two months, a 133% increase focused on transportation and manufacturing. MuddyWater was the most active group, targeting at least five US companies, followed by APT33 with at least three; OilRig, CyberAv3ngers, FoxKitten and Homeland Justice were also active. In a separate report, Morphisec said Fox Kitten is recruiting ransomware affiliates with an 80% share of proceeds for attacks against Iran's adversaries, including the US and Israel. The activity comes amid heightened concerns over Iranian cyber retaliation after US strikes on Iranian nuclear facilities.

The RecordSep 8, 00:00 UTC · 7d agoThreat actor in the wild1· 1 read

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.

Kaspersky reported new components in the Cavern (Cav3rn) C2 framework, used by Iranian MOIS-affiliated Cavern Manticore (with overlaps to MuddyWater and OilRig's Lyceum) against Israeli entities, monitored since December 2025. The new GoogleService.dll module performs DNS A-record queries to choose between direct HTTPS and a Google Apps Script relay per transaction, with the DNS infrastructure able to rotate the Google deployment ID; Kaspersky also found an inter-component broker (rnp.dll) and linked the framework's plugin-based pivot to late April 2026. Separately, Group-IB and Kaspersky detailed HOLLOWGRAPH, a .NET NativeAOT DLL first seen in the wild June 7, 2026, that uses Microsoft 365 calendar events via the Graph API as two-way dead drops dated May 13, 2050, with DNS tunneling refreshing Entra ID credentials. DarkAtlas also reported APT42's TAMECAT modular surveillance framework delivered via LNK masquerading as PDFs in spear-phishing targeting the nuclear energy sector in April-May 2026, with the group using generative AI to accelerate operations.

The Hacker NewsAug 18, 12:12 UTC · 28d agoThreat actor

Appears with

threat actor OilRig 2 threat actor APT42 1 threat actor Cavern Manticore 1 threat actor CyberAv3ngers 1 threat actor FoxKitten 1 threat actor Homeland Justice 1 malware Cavern 1 malware HOLLOWGRAPH 1 malware TAMECAT 1 organization Check Point Research 1 product Microsoft 365 1 product Microsoft Graph API 1 vendor Group-IB 1 vendor Kaspersky 1 vendor Morphisec 1 threat actor APT33 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.