GRAMDOOR

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.gramdoor

Threat Analysis

GRAMDOOR is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://thehackernews.com/2022/02/irans-muddywater-hacker-group-using-new.html

→https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a

→https://www.cisa.gov/uscert/sites/default/files/publications/AA22-055A_Iranian_Government-Sponsored_Actors_Conduct_Cyber_Operations.pdf

→https://www.inforisktoday.com/muddywater-targets-critical-infrastructure-in-asia-europe-a-18611

→https://www.mandiant.com/resources/telegram-malware-iranian-espionage

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

GRAMDOORwin.gramdoorSmall Sieve

External Intelligence

Malpedia: win.gramdoor

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search GRAMDOOR