MuddyWater__2022__CISA_AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations_02-24-2022.pdf

**Joint Cybersecurity Advisory** attributing widespread cyber espionage and malicious operations to the Iranian government‑sponsored APT group MuddyWater (aka Earth Vetalia/Seedworm/Static Kitten), detailing their spearphishing campaigns, exploitation of known vulnerabilities (e.g., CVE‑2020‑1472, CVE‑2020‑0688), multiple malware families (PowGoop, Small Sieve, Canopy/Starwhale, Mori, POWERSTATS), extensive TTPs and IOCs (including numerous IP addresses, file hashes, registry keys and scripts), and providing detection, mitigation, and reporting guidance for affected organizations.