RustyWater
RustyWater is a Rust-based remote access trojan/backdoor associated in public reporting with the Iranian threat actor MuddyWater (also tracked as Seedworm, Mango Sandstorm, Static Kitten, MERCURY, TA450, TEMP.Zagros, and Earth Vetala) and assessed as linked to MOIS. Reporting describes it as part of MuddyWater’s shift away from primarily PowerShell/VBS-heavy tooling toward more modular and stealthier Rust implants. It has been observed in spear-phishing campaigns targeting organizations across the Middle East, with repeated reporting on diplomatic, maritime, financial, telecommunications, and government entities; Israel is described as a primary focus in some reporting, with additional targeting across other Middle Eastern countries and GCC states.
The documented infection chain uses spear-phishing emails impersonating legitimate or official communications, often themed as cybersecurity guidelines, policy documents, maritime or diplomatic matters, financial compliance, or alerts. Attached malicious Microsoft Word documents contain VBA macros that require the victim to enable macros/content. Reported macro behavior includes extracting hex-encoded payload data from a UserForm/TextBox, converting it to binary, writing it to C:\ProgramData\CertificationKit.ini, and executing it via obfuscated WScript.Shell/cmd.exe command construction using Chr()/ASCII-value reconstruction. Some reporting notes icon spoofing and a dropped stage-2 PE disguised as "reddit.exe" with a Cloudflare logo.
RustyWater is described as using encrypted or obfuscated HTTP command-and-control implemented with Rust libraries including reqwest and tokio, with asynchronous communications, configured timeouts, connection pooling, retry logic, and randomized sleep/jitter to reduce detectability. Collected data is reported to be structured as JSON and protected through layered obfuscation/encryption, including Base64 encoding and XOR encryption; the content specifically states RustyWater has encoded collected data with Base64. Reported host reconnaissance includes collection of username, computer name, and domain details. The malware is also described as supporting file operations and command execution, modular post-exploitation expansion, and in some reporting process injection into explorer.exe using VirtualAllocEx and WriteProcessMemory.
Persistence is reported via Windows Registry Run keys, specifically under the current user, pointing to C:\ProgramData\CertificationKit.ini. Anti-analysis and evasion features described in the content include anti-debugging, anti-VM checks, anti-tampering via a vectored exception handler, position-independent XOR string encryption, and discovery of more than 25 antivirus/EDR products by checking service names, files, and installation paths, with behavior changes when security tools are detected.
High-confidence indicators and artifacts directly mentioned in the content include the dropped path C:\ProgramData\CertificationKit.ini, registry path SOFTWARE\Microsoft\Windows\CurrentVersion\Run, the reqwest/0.12.23 user-agent string, and a reported C2 domain nomercys.it[.]com. Reported sample hashes include 76aad2a7fa265778520398411324522c57bfd7d2ff30a5cfe6460960491bc552 and f38a56b8dc0e8a581999621eef65ef497f0ac0d35e953bd94335926f00e9464f. Some reporting notes limited overlap or naming alignment with variants referred to as Archer RAT or RUSTRIC.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
По публичным отчётам, Seedworm предположительно наращивает инструментарий: упоминаются RustyWater (Rust-based RAT), а также злоупотребление RMM-инструментами Syncro и PDQ Connect...
"...Muddy Water APT... deliver Rust based implants..." (report title references "RustyWater implant")
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
5 techniques
Execution
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
The group's WMI-based persistence and memory-resident implant execution are specifically designed to evade the host-based detection tools most commonly deployed in government environments.
Execution & Persistence: PowerShell/PowerGoop, Rust-based implants (RustyWater/CHAR/Archer RAT), registry Run keys, scheduled tasks (T1059.001, T1547.001).
Persistence
2 techniques
Persistence
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or batch files in the Windows Startup folder.
Privilege Escalation
3 techniques
Privilege Escalation
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
The RustyWater implant and the CHAR backdoor represent the apex of this evolution, incorporating asynchronous C2 communication, process injection, layered encryption
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or batch files in the Windows Startup folder.
Stealth
6 techniques
Stealth
Evasion: Anti-debugging, anti-VM, position-independent XOR encryption, randomised sleep intervals
The RustyWater implant and the CHAR backdoor represent the apex of this evolution, incorporating asynchronous C2 communication, process injection, layered encryption
“…employ multiple obfuscation techniques (T1140) …” / “modified UPX packing … encrypts its configuration using AES-256-CBC …”
Credential Access
1 technique
Credential Access
Discovery
2 techniques
Discovery
Collection
1 technique
Collection
Command and Control
4 techniques
Command and Control
“most commonly rely on application layer protocols (T1071), such as HTTP …” and multiple groups use HTTPS/Discord/Telegram/DoH/MQTT.
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rust-based remote access trojan reportedly associated with Seedworm's evolving toolset.
A Rust-based implant reportedly used by MuddyWater for stealthy pre-positioning and persistent access in targeted networks.
A Rust-based remote access trojan using encrypted HTTP command-and-control, with anti-debugging, anti-VM, XOR encryption, and randomized sleep intervals for evasion.
Rust-based backdoor referenced as part of known MuddyWater operations targeting Israeli government entities.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.