MuddyWater

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its priv

Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line pro

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Cit

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code f

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the na

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerabi

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different creden

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat act

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publ

Fooder is a custom 64-bit C/C++ loader used by MuddyWater that can

Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on

LP-Notes is a C/C++ Windows credential stealer used by MuddyWater.

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modul

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

Mori is a backdoor that has been used by MuddyWater since at least

MuddyViper is custom backdoor written in C and C++ used by [MuddyWater](https://attack.mitre.org/groups/G00

Out1 is a remote access tool written in python and used by [MuddyWater](https://attack.mitre.org/groups/G00

POWERSTATS is a PowerShell-based first stage backdoor used by [MuddyWater](https://attack.mitre.org/groups/

PowGoop is a loader that consists of a DLL loader and a PowerShell-based downloader; it has been used by [M

PowerSploit is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Driv

RemoteUtilities is a legitimate remote administration tool that has been used by [MuddyWater](https://attac

RustyWater is a Rust-based implant used by MuddyWater. Historicall

SHARPSTATS is a.NET backdoor used by MuddyWater since at least 20

STARWHALE is Windows Script File (WSF) backdoor that has been used by [MuddyWater](https://attack.mitre.org

Small Sieve is a Telegram Bot API-based Python backdoor that has been distributed using a Nullsoft Scriptab

Tsundere Botnet is a botnet first reported in mid-2025 that is delivered via MSI installer or a PowerShell