# MuddyWater APT deploys PowGoop, Small Sieve targeting global sectors

Published: 2026-03-10 · Severity: high · Sectors: government-national, defense, telecommunications, energy
Canonical: https://vorant.io/reports/f44a9569-3988-56df-b378-f14ef96d4b5c/muddywater-apt-deploys-powgoop-small-sieve-targeting-global-sectors

> Iranian MOIS-linked MuddyWater APT conducts espionage using malware loaders and exploit known CVEs against government and commercial networks globally.

FBI, CISA, U.S. Cyber Command, and UK NCSC report sustained cyber espionage by MuddyWater, an Iranian Ministry of Intelligence and Security (MOIS) subordinate APT group active since approximately 2018. The group targets government and private-sector organizations across telecommunications, defense, local government, and energy sectors in Asia, Africa, Europe, and North America. MuddyWater operators employ spearphishing with malicious Excel macros and ZIP attachments, exploit publicly known vulnerabilities including CVE-2020-1472 (Netlogon) and CVE-2020-0688 (Exchange), and deploy a toolset including PowGoop (DLL-based loader using Google Update impersonation), Small Sieve (Python backdoor using Telegram API for C2), Canopy/Starwhale (WSF-based implant), Mori (DNS tunneling backdoor), and POWERSTATS (PowerShell persistence tool). The group uses DLL side-loading, obfuscated PowerShell scripts, and custom string obfuscation for defense evasion.

MuddyWater actors maintain persistence through registry run keys, side-loaded libraries, and PowerShell beacons. Small Sieve specifically impersonates Windows Defender and Microsoft Outlook in filenames to avoid detection and uses Telegram Bot API over HTTPS with hex byte-swapped encoding for command-and-control. The malware collects system information (IP, computer name, username) and can execute arbitrary commands. Defenders should prioritize patching CVE-2020-1472 and CVE-2020-0688, hunt for the IOC IP addresses and malware families listed, and monitor for spearphishing with Office macros and ZIP attachments.

## Mentioned in this report

- Vulnerabilities: CVE-2020-0688 (KEV), CVE-2020-1472 (KEV)
- Threat actors: MuddyWater
- Malware: Canopy, Mori, POWERSTATS, PowGoop, STARWHALE, Small Sieve

## Detection guidance (public sample)

### Python Interpreter Connecting to Telegram Bot API

ATT&CK: T1071.001

Python process making a network connection to api.telegram.org, consistent with Small Sieve Python backdoor C2 over the Telegram Bot API. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Python Interpreter Connecting to Telegram Bot API
id: dbdd1ffb-53cb-57bc-9b6d-2190a797692f
status: experimental
description: Detects python.exe or pythonw.exe connecting to the Telegram Bot API
  over HTTPS. Small Sieve (MuddyWater) is a Python backdoor that uses the Telegram
  API for C2. Generalises on the interpreter-to-Telegram relation, not on a specific
  bot token or filename.
tags:
- attack.command-and-control
- attack.t1071.001
- attack.t1059.006
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \python.exe
    - \pythonw.exe
    DestinationHostname|contains: api.telegram.org
  condition: selection
falsepositives:
- Legitimate Python-based Telegram bots or notification scripts run by developers
  or admins
- Monitoring scripts that post alerts to Telegram
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
```

### Google Update DLL Side-Loading from Non-Standard Location

ATT&CK: T1574.001

goopdate.dll loaded from outside the legitimate Google Update install paths, matching PowGoop DLL side-loading via Google Update impersonation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Google Update DLL Side-Loading from Non-Standard Location
id: 5f5b8560-8841-5f03-92b3-6f5c7c2a78df
status: experimental
description: Detects goopdate.dll being loaded from a directory other than the legitimate
  Google install paths. PowGoop (MuddyWater) uses a malicious DLL loaded by a copy
  of the legitimate Google Update executable to masquerade as Google Update.
tags:
- attack.stealth
- attack.persistence
- attack.t1574.001
- attack.t1036.005
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \goopdate.dll
  filter_legit:
    ImageLoaded|startswith:
    - C:\Program Files\Google\
    - C:\Program Files (x86)\Google\
  filter_user_install:
    ImageLoaded|contains: \AppData\Local\Google\
  condition: selection and not 1 of filter_*
falsepositives:
- Google software installed to a custom non-default directory
- Portable Chrome or Google Update packaging unpacked in temporary directories
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
```

### Office Excel Spawning Script Interpreter

ATT&CK: T1566.001

Excel spawning PowerShell, WScript, CScript, MSHTA or Python, matching MuddyWater spearphishing with malicious Excel macros. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Excel Spawning Script Interpreter
id: 2a255498-7791-5f4c-a914-e27afbea8180
status: experimental
description: Detects Excel launching a script interpreter such as PowerShell, WScript,
  CScript, MSHTA or Python. Matches malicious Excel macro attachments used by MuddyWater
  to run obfuscated PowerShell or deploy loaders.
tags:
- attack.execution
- attack.t1204.002
- attack.t1566.001
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \EXCEL.EXE
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \python.exe
    - \pythonw.exe
  condition: selection
falsepositives:
- Finance or reporting workbooks with legitimate macros that call PowerShell or scripts
- Excel add-ins that invoke helper scripts
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f44a9569-3988-56df-b378-f14ef96d4b5c/muddywater-apt-deploys-powgoop-small-sieve-targeting-global-sectors.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup