FalconFeeds.io. (2026, March 5). The Digital Redoubt: Iran’s National Information Network and the Asymmetry of Modern Cyber Conflict. Retrieved March 9, 2026.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1090 Proxy |
GroupMuddyWater | MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France. |
| T1219.002 Remote Desktop Software |
GroupMuddyWater | MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration. |
| T1534 Internal Spearphishing |
GroupMuddyWater | MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
