KEY TAKEAWAYS
- MuddyWater (MOIS) is an Iranian threat actor whose infrastructure is currently tracked and active, with predictions recorded as recently as January 2026.
- Observed data indicate a sustained shift in Iranian infrastructure acquisition behavior between 2019 and 2022, during which coverage of OilRig and APT33 dropped to zero. This reflects a change in how actors obtain and configure infrastructure, not a cessation of operations.
- Two MuddyWater-attributed clusters show a notable burst of new infrastructure in September 2025, seven CIDRs flagged over 72 hours, followed by an additional detection in January 2026, approximately one month before the February 28 US-Israel strikes on Iran.
- The September 2025 and January 2026 infrastructure is hosted across three distinct providers (AS62005 BV-EU-AS, AS62240 Clouvider, AS203020 HostRoyale), consistent with a deliberate provider diversification strategy.
- The broader Iranian hacktivist ecosystem has expanded significantly following the February 28 strikes, with dozens of aligned groups now engaging in retaliation.
- Despite lulls in direct Iranian cyber action, affiliate groups remain active and continue to retaliate against regional targets alongside Iran’s kinetic retaliation.
1. Background and Analytical Scope
This report assesses Iranian state-sponsored and state-aligned threat-actor infrastructure using data from the Augur Security Predictive Intelligence platform, corroborated by open-source intelligence. The platform produces IP- and CIDR-level insights from behavioral and infrastructure fingerprinting, grouping predictions into clusters that represent likely shared-actor infrastructure.
The assessment covers the following Iranian actors active in 2024-2026: MuddyWater (MOIS), OilRig/APT34 (MOIS), APT35/Charming Kitten (IRGC-IO), APT33/Peach Sandstorm (IRGC), Cotton Sandstorm/Emennet Pasargad (IRGC), CyberAv3ngers (IRGC-CEC), and Handala (assessed MOIS-linked). Augur’s data is included only where predictions are directly tagged with verified Iranian actor identifiers or associated malware families.
Augur assesses with medium-high confidence that Iran’s current cyber posture has been weakened by sustained U.S. and Israeli strikes on military sites. As known bases and fallback locations continue to come under aircraft and drone attack, the lull in Iranian operations likely reflects real disruption to operator safety and supporting digital infrastructure. Iran’s total internet blackouts on January 8, 2026, and February 28, 2026, further support that assessment, with traffic falling to 4% (NetBlocks) in the first few days of the campaign, then dropping below 1% in early March. Augur tracking of operator infrastructure and OSINT also confirms this quieter posture among core Iranian operators.
At the same time, the Iranian response is far from silent. Alongside Iran's initial retaliation of drones and missiles, Western and Gulf states have seen a surge in activity from Iran-aligned affiliate groups such as Handala Hack Team, APT Iran, and the Russian DDoS group NoName057. These actors have carried out more of the visible response through sustained DDoS attacks, phishing, and disruptive operations in response to U.S. and Israeli strikes. Handala’s destructive attack on U.S. medical provider Stryker is one example, but Augur believes the operation was opportunistic and consistent with the tradecraft seen in prior Handala activity, not as evidence of a broader expansion in Iranian cyber activity or targeting of the healthcare industry. The attack deployed a wiper that erased servers, employee devices, and some personal devices, which Handala justified by describing Stryker as a “Zionist rooted corporation.”
The traditional Iranian APT model, now under heavier scrutiny from researchers and law enforcement due to a 2025 internal document leak, has increasingly given way to state-directed hacktivist groups and affiliate personas. While Iran’s threat level remains high, Augur believes that many publicly claimed intrusions during the February to March 2026 conflict were opportunistic or exaggerated. Despite this, organizations in the region or otherwise exposed to Iran-aligned activity should prioritize patching edge devices, updating outdated software, and remediating known vulnerabilities.
1.1 GEOPOLITICAL CONTEXT AND CYBER ESCALATION TIMELINE
The following timeline captures the key kinetic and cyber escalation milestones shaping the current threat environment:
2. Augur Coverage: Iranian Actor Clusters
We observed that across all predictive clusters for Iranian actor tags, associated malware families, and relevant CVEs, the corpus of profiles spanned from 2012 to March 2026. After filtering for clusters with verified Iranian-specific identifiers, the following profiles constitute the dataset used for this assessment. Within that dataset, Iranian digital threat posture remains mixed. Recent activity is more limited among core operators, while affiliated actors and older infrastructure continue to shape the overall threat picture.
2.1 Currently Active Clusters
Both clusters carry BugSleep tags alongside muddywater, consistent with MuddyWater's documented use of BugSleep malware and operational focus on Middle Eastern nexus targeting. Profile 137113 has 11 total predictions across three distinct phases dating to October 2020. Profile 152131 has 14 predictions across three phases dating to March 2022.
2.2 Recently Inactive Clusters (2020-2023)
Profile 146971 carries the broadest set of MuddyWater-associated aliases in the dataset, including seedworm, static_kitten, and temp_zagros alongside muddywater, reflecting the consolidation of multiple tracking designations for the same actor group under a single cluster. Its most recent prediction dates to September 2023, placing it in a transitional position between the active clusters above and the fully dormant pre-2020 clusters below. The three active CIDRs on this profile represent infrastructure that has not been refreshed since that date and may no longer be operationally relevant for Iranian-linked threat actors.
Profile 90022 is the only APT33-attributed cluster, and its last prediction in June 2020 marks the latest time APT33-associated infrastructure was observed. The 27 predictions and 27 active CIDRs on this profile indicate a meaningful footprint at the time of last observation. Profile 128727 is a second MuddyWater/BugSleep cluster that went inactive in May 2020, within weeks of the APT33 cluster, suggesting a broader infrastructure switch observed among multiple Iranian actors during that period. Profile 108388 is notable for hosting both muddywater and cotton_sandstorm/emennet_pasargad on the same cluster, which may reflect shared infrastructure between MOIS and IRGC-affiliated operators.
2.3 Historical OilRig/APT34 Clusters (2016-2019)
Profile 88555 is the densest single-actor cluster in the Iranian corpus with 195 predictions and 92 active CIDRs at the time of last observation in August 2019, and represents the platform’s most complete historical coverage of OilRig infrastructure. The ismdoor tag across profiles 88555, 77245, and 51928 reflects consistent detection of OilRig’s custom backdoor across multiple infrastructure clusters spanning 2016 to 2019, indicating the fingerprint was stable enough for the model to track across multiple acquisition cycles during that period.
Profile 51928 is the earliest OilRig cluster in the dataset, first predicted in December 2015, and is the only cluster carrying both Shamoon and Shamoon2 tags alongside the OilRig/helix_kitten identifiers. This co-occurrence places OilRig-attributed infrastructure in proximity to the destructive wiper campaigns targeting Saudi Arabian organizations in 2016 and 2017, consistent with open-source reporting on OilRig’s role within the broader Iranian offensive cyber ecosystem during that period. Profile 10743 carries apt34 alongside oilrig and cleaver, reflecting the overlap between those three tracking designations in the 2014 to 2016 timeframe before the intelligence community settled on more standardized nomenclature.
3. Infrastructure Acquisition Behavior: A Tracked Transition
One of the most significant findings from our dataset is the trajectory of prediction coverage across Iranian actor clusters over time. The data documents not the absence of Iranian actors, but a documented shift in how those actors acquire and configure infrastructure.
3.1 Phase 1: Direct Allocation (2015-2019)
OilRig/APT34 infrastructure was the most densely predicted category in the Iranian corpus. Profile 88555 alone accounts for 195 predictions, with 92 active inet records, representing the largest single-actor cluster in the dataset. Profiles 77245, 74406, and 51928 add further coverage through 2018. The prediction model consistently fingerprinted this infrastructure, suggesting a relatively stable, detectable acquisition pattern during this period.
APT33 and Charming Kitten infrastructure appear in profiles 90022 and several earlier clusters, with the most recent APT33-tagged prediction recorded in June 2020. MuddyWater appears in historical clusters 62189 and 51553 as early as 2015, with tools including PhonyC2, Phishery, and early versions of what would later be classified as the Seedworm/Static Kitten toolset.
3.2 Phase 2: Transition and Coverage Gap (2019-2022)
OilRig predictions cease entirely after August 2019. APT33 last appeared in June 2020. This is not assessed to reflect actor retirement. Iranian actors are well documented in open-source intelligence to have rotated their infrastructure acquisition methods during this period, moving toward leased BPH provider space, front-company registrations, and permissive Western hosting. The platform's fingerprinting model, calibrated to the prior acquisition pattern, lost signal when the underlying behavior changed.
This gap represents a known limitation of prediction-based systems: infrastructure behavioral models require recalibration when actors change procurement methods. The absence of OilRig and APT33 signals from 2020 onward should be treated as a coverage gap rather than evidence that those actors are inactive.
3.3 Phase 3: Re-acquisition on BPH-Adjacent Infrastructure (2020-Present)
MuddyWater re-emerges at the beginning of October 2020 with profile 137113, followed by profile 152131 in March 2022. Critically, the new infrastructure sits on a different hosting class than the 2015-2019 OilRig clusters. The recent MuddyWater detections are observed on HostRoyale (AS203020, India-registered, Albania-geolocated space), BV-EU-AS (AS62005, Estonian-registered ASN allocated in February 2022), and Clouvider (AS62240, UK-registered general hosting). This is consistent with the BPH-adjacent infrastructure pattern.
MuddyWater was again observed using new infrastructure with a different fingerprint and became detectable under the updated model. That reappearance is consistent with broader reporting showing the actor remained active, including through quieter persistence inside U.S. organizations in early February 2026. Unit42 reporting identified MuddyWater-linked backdoors in several U.S. networks, including banks, airports, and nonprofits, reinforcing that the actor has never stopped operating and has adapted its infrastructure, access patterns, and visibility profile. The platform tracked them through a behavioral transition and re-established coverage on the other side.
This matters to the current threat picture. Reduced visibility into core Iranian operators is not to be mistaken for inactivity. It is at least partly a function of infrastructure transitions, procurement changes, and a quieter operating model, allowing core operators to hide as affiliate groups generate more overt disruption.
4. Recent Infrastructure Activity: September 2025 and January 2026
The two currently active MuddyWater clusters show a concentrated pattern of new infrastructure acquisitions in the six months preceding the February 28 US-Israel strikes on Iran, designated Operation Epic Fury/Operation Roaring Lion.
4.1 Profile 152131: September 2025 Burst
Seven CIDRs were flagged across a 72-hour window from September 18 to 20, 2025. Five of the seven sit on AS62005 BV-EU-AS, an Estonian-registered ASN allocated in February 2022. The country codes assigned to these prefixes span Russia, the United Kingdom, and Estonia, a mixed allocation profile consistent with BPH provider behavior. The /25 pair pattern on 62.204.35.0/24 and 213.232.236.0/24 is consistent with subnet splitting observed in prior MuddyWater allocation phases. The remaining two CIDRs are on AS62240 Clouvider, a UK-based general hosting provider with a documented history of abuse by multiple threat actor groups.
This burst occurred approximately five months before the February 28 strikes, a timeframe consistent with pre-operational infrastructure staging. This assessment for the temporal correlation is made with medium confidence that this specific buildup was in preparation for post-strike operations. The pattern is consistent with pre-positioning but could also reflect routine infrastructure expansion.
4.2 Profile 137113: January 2026 Detection
A single /24 on HostRoyale (AS203020) was flagged on January 28, 2026, approximately one month before the strikes. This is the third phase of activity on profile 137113, following the October 2020 initial burst and the February 2022 cluster. HostRoyale is an Indian-registered provider operating Albanian address space, a combination consistent with layered jurisdictional obfuscation. This provider has appeared across multiple phases of the profile's history, suggesting either a persistent operator preference or a standing arrangement.
4.3 Infrastructure Provider Divergence
The September 2025 and January 2026 detections use different provider ecosystems despite being attributed to the same actor group. BV-EU-AS and Clouvider represent a distinct hosting stack from HostRoyale. This divergence is consistent with one of two assessments: either deliberate provider diversification to reduce single-point detection risk, or two operationally distinct sub-clusters within the broader MuddyWater group that use separate infrastructure procurement channels. Either interpretation suggests a maturing operational security posture relative to the 2020 acquisition patterns.
5. Open-Source Context: Iranian Actors in 2025-2026
5.1 MuddyWater / TA450 (MOIS)
MuddyWater, attributed to Iran's Ministry of Intelligence and Security, has been among the most consistently active Iranian actors across 2024-2026. Recent campaigns have employed BugSleep, MuddyViper, RustyWater, and an updated version of PhonyC2 as primary tooling. The group has continued targeting government, defense, and critical infrastructure organizations across the Middle East, with particular focus on Israel, Saudi Arabia, and Azerbaijan. Operation Olalampo, reported in February 2026, involved the deployment of AI-assisted backdoors against energy and marine-sector targets across the MENA region. MuddyWater's continued use of commodity malware alongside bespoke tooling is consistent with the mixed tool profile observed in platform clusters 137113 and 152131.
February 2026 also saw MuddyWater activity, albeit less visible. Reporting identified a series of MuddyWater-linked backdoors embedded in dozens of organizations ranging from banks to airports to nonprofits. The use of the new “Dindoor” backdoor pointed to access retention and quieter foothold maintenance, more consistent with stealthy persistence than overt disruption. For Augur, this tracks with the broader assessment: MuddyWater remains operational, but through stealthier persistence and infrastructure staging.
5.2 OilRig / APT34 / Helix Kitten (MOIS)
OilRig remained active through at least October 2025, with reporting covering spear-phishing campaigns targeting energy and financial-sector organizations, credential harvesting via custom web shells, and continued use of the RDAT backdoor and the Veaty implant. Despite the absence of OilRig-tagged predictions in the platform after August 2019, open-source reporting does not support the conclusion that OilRig infrastructure went dormant. The platform coverage gap is assessed to reflect the infrastructure acquisition transition described in Section 3.
After October, Augur threat intelligence team tracked the broader OilRig cluster through its affiliate group, BladedFeline. Mainly targeting Iraq and the Kurdistan Regional Government, BladedFeline has focused on malware development and expanding access within key industries (energy, telecommunications, intelligence, and law enforcement). Augur confirmed this link through PrimeCache, an implant utilized by BladedFeline that closely resembles OilRig’s RDAT backdoor. Augur assesses with medium confidence that the group’s sudden dormancy is not permanent but instead reflects operational disruption caused by kinetic strikes.
5.3 APT35 / Charming Kitten / Mint Sandstorm (IRGC-IO)
Recent reporting continued to show tailored phishing, impersonation, and MFA-focused tradecraft directed at high-value individuals, including researchers and dissidents. This remained consistent with Augur's assessment of the group, which seems to have a long-standing preference for silent intelligence collection.
Since the US-Israeli strikes began, the group has sporadically appeared. Operators have quietly reemerged in phishing campaigns targeting U.S. policy experts. Despite APT35’s preference for stealthy operations, the lack of notable activity aside from infrastructural staging and phishing attempts supports Augur's belief that operators face varying logistical challenges amidst bombardment, relying on affiliate groups like Handala for disruption and strength projection.
5.5 Cotton Sandstorm / Emennet Pasargad (IRGC)
Cotton Sandstorm, the IRGC entity operating as Emennet Pasargad, has conducted influence operations and disruptive cyber activity across multiple countries. Augur tracking continues to link the group to operations against Israel, the United States, France, and Sweden, blending information operations and staged personas for infiltration. WezRat, as Emennet Pasargad-linked tooling, was also used in support of these operations. Cotton Sandstorm tags appear in platform profile 108388 (last predicted August 2019), alongside muddywater and powgoop tags, which are notable given that those actors are assessed to MOIS rather than IRGC. This co-occurrence may reflect infrastructure overlap or a platform tagging artifact, but it is not sufficient to conclude organizational overlap.
5.6 CyberAv3ngers (IRGC-CEC)
CyberAv3ngers, attributed to the IRGC Cyber and Electronic Command, has targeted industrial control systems in water treatment, gas distribution, and energy facilities. The IOControl backdoor, designed specifically for SCADA and ICS environments, represents a significant capability uplift relative to prior campaigns. CyberAv3ngers does not appear in the current platform prediction clusters, reflecting the specialized, limited-footprint nature of ICS-focused operations rather than inactivity.
5.7 Handala
Handala emerged in late 2023 and has conducted data exfiltration and wiper operations primarily targeting Israeli organizations. The group's operational patterns and targeting profile are assessed as consistent with MOIS direction or sponsorship, though direct attribution to a specific MOIS unit has not been publicly confirmed. Handala intensified activity in January and February 2026 and is assessed to be participating in the coordinated Iranian cyber response to the February 28 strikes. The group does not appear in the current platform prediction clusters.
On March 11, as part of the broader Iran aligned cyber response, Handala Hack Team claimed responsibility for a destructive attack on U.S. medical company Stryker. Utilizing Microsoft Intune, attackers were able to push mass wiping commands throughout company servers, emails, devices, with some reporting the wiping of personal devices. Stryker confirmed the breach in public remarks the following day, revealing the incident caused a global disruption to company operations, prosthetics shipping, and even some surgical operations across the U.S. Handala framed the operation as retaliation for strikes against Iran and cast Stryker as a “Zionist rooted corporation,” with defacements referencing the company’s Israeli ties through its 2019 OrthoSpace acquisition.
In spite of the breach’s scale, Augur surmises this attack to likely be a result of opportunistic infiltration. The attack appears better explained by available access and symbolic value rather than a new campaign against core U.S. healthcare infrastructure.
6. Post-Strike Hacktivist Mobilization
The February 28 US-Israel strikes on Iran triggered a rapid expansion of Iranian-aligned hacktivist activity. An Electronic Operations Room was established within 24 hours of the strikes, providing centralized coordination for an estimated 60 or more hacktivist groups ranging from Russia to Iran and all across the Middle East. This structure mirrors the coordination mechanisms observed following the October 2023 escalation of the Gaza conflict.
Active groups in the immediate post-strike period include Cyber Fattah, Fatimiyoun Cyber Team, the Russian NoName057, and affiliated collectives operating under Cotton Sandstorm coordination. Handala has also claimed multiple operations, with numerous more claimed to be active though none have been attributed aside from the Stryker infiltration. The group’s targeting focus continues to be Israeli and US government, financial, and critical infrastructure organizations, with a secondary focus on Gulf states accused of facilitating US/Israeli strikes.
Iranian national internet connectivity collapsed to 4 percent before later falling to 1 percent during the strike period and remains ~1 percent at the time of this assessment. Disruption to domestic infrastructure has historically correlated with increased external cyber activity from Iranian state actors, but recent Iranian-related cyber activity continues to stem from affiliates and ideological allies.
7. Malware and Tooling Reference
The following malware families are associated with Iranian actors and relevant to the infrastructure clusters documented in this report.
