MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors.

The Iranian threat actor known as MuddyWater has been linked to a spear-phishing campaign targeting diplomatic, maritime, financial, and telecommunications entities in the Middle East, using a Rust-based implant codenamed RustyWater.

"The campaign uses icon spoofing and malicious Word documents to deliver Rust-based implants capable of asynchronous C2, anti-analysis, registry persistence, and modular post-compromise capability expansion," CloudSEK resetter Prajwal Awasthi said in a report published this week.

The latest development reflects the continued evolution of MuddyWater's tradecraft, which has gradually but steadily reduced its reliance on legitimate remote access software as a post-exploitation tool in favor of a diverse custom malware arsenal comprising tools like Phoenix, UDPGangster, BugSleep (aka MuddyRot), and MuddyViper.

Also tracked as Mango Sandstorm, Static Kitten, and TA450, the hacking group is assessed to be affiliated with Iran's Ministry of Intelligence and Security (MOIS). It's been operational since at least 2017.

Attack chains distributing RustyWater are straightforward: spear-phishing emails masquerading as cybersecurity guidelines are attached to a Microsoft Word document that, when opened, instructs the victim to "Enable content" to execute a malicious VBA macro that deploys the Rust implant binary.

Also referred to as Archer RAT and RUSTRIC, RustyWater gathers victim machine information, detects installed security software, sets up persistence by means of a Windows Registry key, and establishes contact with a command-and-control (C2) server ("nomercys.it[.]com") to facilitate file operations and command execution.

It's worth noting that the use of RUSTRIC was flagged by Seqrite Labs late last month as part of attacks targeting Information Technology (IT), Managed Service Providers (MSPs), human resources, and software development companies in Israel. The cybersecurity company is tracking the activity under the names UNG0801 and Operation IconCat.

"Historically, MuddyWater has relied on PowerShell and VBS loaders for initial access and post-compromise operations," CloudSEK said. "The introduction of Rust-based implants represents a notable tooling evolution toward more structured, modular, and low noise RAT capabilities."

Found this article interesting? Follow us on Google News, Twitter, and LinkedIn to read more exclusive content we post.