We refer to these attacks as MuddyWater due to the confusion in attributing these attacks. Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related. The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. These attacks have also been tracked by several other researchers on Twitter and elsewhere. The activity has been consistent throughout 2017 and, based on our analysis, targets or is suspected to target, entities in the following countries