H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Mori

[Mori](https://attack.mitre.org/software/S1047) is a backdoor that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least January 2022.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: CYBERCOM Iranian Intel Cyber January 2022)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Mori](https://attack.mitre.org/software/S1047) is a backdoor that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least January 2022.(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: CYBERCOM Iranian Intel Cyber January 2022)

Labels

malware
10 recorded

Relationships

uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DNS
Technique
uses
to File Deletion
Technique
uses
to Junk Data
Technique
uses
to Modify Registry
Technique
uses
to Query Registry
Technique
uses
to Regsvr32
Technique
uses
to Standard Encoding
Technique
uses
to Web Protocols
Technique
uses
from MuddyWater
Group
3 external

References

mitre-attack
S1047
open
CYBERCOM Iranian Intel Cyber January 2022
https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/
open
DHS CISA AA22-055A MuddyWater February 2022
https://www.cisa.gov/uscert/ncas/alerts/aa22-055a
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance