Catching fish in muddy waters

This Group-IB analysis describes a series of leaks and active campaigns by Iran-linked APTs (OilRig/APT34 and MuddyWater) that exposed source code, victim lists, and operational infrastructure. The report details MuddyWater’s use of the POWERSTATS PowerShell backdoor, lists C2 servers and file hashes, and documents a targeted phishing campaign against Turkish defense contractor ASELSAN that leveraged decoy documents and previously leaked credentials while presenting potential attribution to individuals using the Gladiyator_CRK / Nima Nikjoo handles.