Iranian threat actor MuddyWater has launched a new wave of spear-phishing campaigns deploying RustyWater, a sophisticated Rust-based remote access trojan (RAT), targeting various sectors in the Middle East, including diplomatic, maritime, financial, and telecom organizations. This development signifies a significant evolution from their previous reliance on PowerShell and VBS loaders.
The RustyWater malware is distributed through spear-phishing emails containing malicious Word documents with VBA macros, as well as ZIP archives, which deliver the implant. This remote access trojan incorporates advanced features such as asynchronous command-and-control (C2) communication, anti-analysis capabilities including anti-debugging and virtual machine detection, and registry persistence. Additional functionalities include string obfuscation, multi-stage payload delivery, and modular post-compromise operations.
The campaigns also employ decoy documents in Hebrew to mislead victims, highlighting its focus on Israel and indicating potential intelligence-gathering objectives linked to regional tensions and operations. Notably, RustyWater’s C2 infrastructure mimics legitimate services like Dropbox and WordPress to evade detection.
The deployment of RustyWater marks MuddyWater’s transition towards more complex tooling in its cyber-espionage operations, positioning this alongside their other tools, such as Phoenix, UDPGangster, and BugSleep. Overall, these tactics underscore the group’s ongoing adaptability and technical sophistication in conducting cyber espionage across the Middle East region.

Collections

Iranian threat actor MuddyWater has deployed RustyWater, a Rust-based remote access trojan, targeting Middle Eastern organizations through spear-phishing campaigns. The malware features asynchronous C2 communication, anti-analysis capabilities, registry persistence, and mimics legitimate services like Dropbox and WordPress for evasion. This represents a significant evolution from PowerShell and VBS loaders, demonstrating the group's shift toward more sophisticated tooling in cyber-espionage operations targeting diplomatic, maritime, financial, and telecom sectors.

MuddyWater Deploys RustyWater RAT in Sophisticated Campaigns Across Middle East