POWERSTATS
MITRE ATT&CK: S0223 View on attack.mitre.org
Aliases: Powermud, Valyria, POWERSTATS
- First seen
- 2017-01-01 00:00:00
- Malware type
- backdoor
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 415 (144 malicious)
- Last IoC activity
- 2026-10-17 01:50:20
- Profile updated
- 2026-07-07 12:52:11
Targeted industries: government-and-public-sector education-and-nonprofits energy-and-utilities
Targeted regions: country_code:sa country_code:ae country_code:ir country_code:il
Context
POWERSTATS is a PowerShell-based first stage backdoor used by MuddyWater.
Recent IoC activity
144 malicious indicators in Maltiverse are attributed to POWERSTATS (S0223). The 20 most recently updated:
Detection coverage
- 1 YARA rules
- 695 Sigma rules
Malware & tools used
- Component Object Model (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- Masquerade Task or Service (attack-pattern)
- Local Account (attack-pattern)
- Security Software Discovery (attack-pattern)
- Mshta (attack-pattern)
- Windows Management Instrumentation (attack-pattern)
- Scheduled Transfer (attack-pattern)
- System Information Discovery (attack-pattern)
- Standard Encoding (attack-pattern)
- External Proxy (attack-pattern)
- Dynamic Data Exchange (attack-pattern)
- PowerShell (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Data from Local System (attack-pattern)
- Disable or Modify Tools (attack-pattern)
- Scheduled Task (attack-pattern)
- Asymmetric Cryptography (attack-pattern)
- Command Obfuscation (attack-pattern)
- File Deletion (attack-pattern)
- Visual Basic (attack-pattern)
- JavaScript (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Screen Capture (attack-pattern)
Used by threat actors
- MuddyWater (threat-actor)
Detection rules
- SECUINFRA_DROPPER_Valyria_Stage_1 (yara-rule)
Reports & references
- Palo Alto Unit 42 — Unit42 Muddying The Water Targeted Attacks In The Middle East (report)
- Mandiant — Iranian Threat Group Updates Ttps In Spear Phishing Campaign (report)
- Trend Micro — Campaign Possibly Connected Muddywater Surfaces Middle East Central Asia (report)
- Broadcom/Symantec — Seedworm Espionage Group (report)
- clearskysec.com — Muddywater Operations In Lebanon And Oman (report)
- clearskysec.com — Muddywater Targets Kurdish Groups Turkish Orgs (report)
- secureworks.com — Cobalt Ulster (report)
- Palo Alto Unit 42 — Boggyserpens (report)
- Kaspersky — 91897 (report)
- reaqta.com — Muddywater Apt Targeting Middle East (report)
- researchcenter.paloaltonetworks.com — Unit42 Muddying The Water Targeted Attacks In The Middle East (report)
- CISA — Aa22 055A (report)
- clearskysec.com — Clearsky Iranian Apt Group %E2%80%98Muddywater%E2%80%99 Adds Exploits To Their Arsenal (report)
- marcoramilli.com — Iranian Threat Actors Preliminary Analysis (report)
- sec0wn.blogspot.com — Continued Activity Targeting Middle East (report)
- deepinstinct.com — Phonyc2 Revealing A New Malicious Command Control Framework By Muddywater (report)
- malpedia.caad.fkie.fraunhofer.de — Ps1.Powerstats (report)
- mp.weixin.qq.com — Nn Irvwa6Yohfs9Z3A0Rba (report)
- shells.systems — Reviving Leaked Muddyc3 Used By Muddywater Apt (report)
- research.checkpoint.com — The Muddy Waters Of Apt Attacks (report)
- sec0wn.blogspot.com — A Quick Dip Into Muddywaters Recent (report)
- Trend Micro — Muddywater Resurfaces Uses Multi Stage Backdoor Powerstats V3 And New Post Exploitation Tools (report)
- clearskysec.com — Muddywater Operations In Lebanon And Oman (report)
- web.archive.org — Falling On Muddywater (report)
- blog.prevailion.com — Summer Mirage (report)