Iran-Linked Cyberespionage Group MuddyWater Escalates Operations with AI-Assisted Custom Malware

Iran-backed threat actor MuddyWater is rapidly expanding its cyberespionage operations across multiple continents, leveraging artificial intelligence to develop stealthier custom malware and sophisticated command infrastructure. The group compromised at least nine organizations across nine countries during the first quarter of 2026, marking a significant escalation in both scale and technical sophistication compared to its historically noisy attack patterns.