POWERSTATS

MITRE ATT&CK: S0223 View on attack.mitre.org

Aliases: Powermud, Valyria, POWERSTATS

First seen
2017-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Related IoCs
8 (3 malicious)
Last IoC activity
2026-09-01 13:56:49
Profile updated
2026-07-07 12:52:11

Targeted industries: government-and-public-sector education-and-nonprofits energy-and-utilities

Targeted regions: country_code:sa country_code:ae country_code:ir country_code:il

Context

POWERSTATS is a PowerShell-based first stage backdoor used by MuddyWater.

Recent IoC activity

3 malicious indicators in Maltiverse are attributed to POWERSTATS (S0223). The 3 most recently updated:

TypeIndicatorUpdatedSources
URL https://paste.sensio.no/PercentReserve/ 2026-05-28 1
URL https://www.mediafire.com/file/1540qpt9gigob8r/CYEO5UP142R8E2EME5LNG.iso/file/ 2026-03-02 1
URL http://gestionycobranzas.com/2/task.vbs 2025-11-23 2

Detection coverage

  • 1 YARA rules
  • 695 Sigma rules

Malware & tools used

  • Component Object Model (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • Local Account (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Mshta (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Scheduled Transfer (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Standard Encoding (attack-pattern)
  • External Proxy (attack-pattern)
  • Dynamic Data Exchange (attack-pattern)
  • PowerShell (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Data from Local System (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Command Obfuscation (attack-pattern)
  • File Deletion (attack-pattern)
  • Visual Basic (attack-pattern)
  • JavaScript (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Screen Capture (attack-pattern)

Used by threat actors

Detection rules

  • SECUINFRA_DROPPER_Valyria_Stage_1 (yara-rule)

Reports & references

  • Palo Alto Unit 42 — Unit42 Muddying The Water Targeted Attacks In The Middle East (report)
  • Mandiant — Iranian Threat Group Updates Ttps In Spear Phishing Campaign (report)
  • Trend Micro — Campaign Possibly Connected Muddywater Surfaces Middle East Central Asia (report)
  • Broadcom/Symantec — Seedworm Espionage Group (report)
  • clearskysec.com — Muddywater Operations In Lebanon And Oman (report)
  • clearskysec.com — Muddywater Targets Kurdish Groups Turkish Orgs (report)
  • secureworks.com — Cobalt Ulster (report)
  • Palo Alto Unit 42 — Boggyserpens (report)
  • Kaspersky — 91897 (report)
  • reaqta.com — Muddywater Apt Targeting Middle East (report)
  • researchcenter.paloaltonetworks.com — Unit42 Muddying The Water Targeted Attacks In The Middle East (report)
  • CISA — Aa22 055A (report)
  • clearskysec.com — Clearsky Iranian Apt Group %E2%80%98Muddywater%E2%80%99 Adds Exploits To Their Arsenal (report)
  • deepinstinct.com — Phonyc2 Revealing A New Malicious Command Control Framework By Muddywater (report)
  • malpedia.caad.fkie.fraunhofer.de — Ps1.Powerstats (report)
  • mp.weixin.qq.com — Nn Irvwa6Yohfs9Z3A0Rba (report)
  • shells.systems — Reviving Leaked Muddyc3 Used By Muddywater Apt (report)
  • research.checkpoint.com — The Muddy Waters Of Apt Attacks (report)
  • sec0wn.blogspot.com — A Quick Dip Into Muddywaters Recent (report)
  • Trend Micro — Muddywater Resurfaces Uses Multi Stage Backdoor Powerstats V3 And New Post Exploitation Tools (report)
  • clearskysec.com — Muddywater Operations In Lebanon And Oman (report)
  • web.archive.org — Falling On Muddywater (report)
  • blog.prevailion.com — Summer Mirage (report)
  • sec0wn.blogspot.com — Clearing Muddywater Analysis Of New (report)
  • CISA — Aa22 055A Iranian Government Sponsored Actors Conduct Cyber Operations (report)

External references