Loading malware…
GhostFetch is a first-stage downloader associated with the Iranian state-linked threat actor MuddyWater, also tracked as Mango Sandstorm, Seedworm, TA450, and Earth Vetala. It was documented in Operation Olalampo, a cyber-espionage campaign first observed in January 2026 that primarily targeted organizations and individuals in the Middle East and North Africa, including sectors such as energy, maritime, diplomatic, financial, telecommunications, and other regional entities.
GhostFetch was delivered through spearphishing emails carrying malicious Microsoft Office documents that relied on macro execution after user interaction. The macro decoded an embedded payload and executed GhostFetch on Windows systems. The malware functioned as a stealthy first-stage downloader and in-memory loader, performing system profiling and anti-analysis checks before retrieving follow-on payloads. Reported checks included validation of mouse movement, screen resolution, debugger presence, virtual machine artifacts, and antivirus products. GhostFetch was also described as using encrypted PE delivery and reflective loading to execute secondary components in memory.
Its primary role in the intrusion chain was to fetch and deploy GhostBackDoor, a second-stage implant that provided interactive shell access and file manipulation capabilities. Reporting also indicates GhostBackDoor could re-run GhostFetch, supporting staged post-compromise operations. In the broader campaign, MuddyWater combined GhostFetch with other tooling including the Rust-based CHAR backdoor and the HTTP_VIP downloader, reflecting a modular intrusion set oriented toward persistence, remote access, and espionage.
Operation Olalampo was characterized as a long-term intelligence collection effort focused on exfiltrating correspondence and documents and mapping victim networks rather than disruption. GhostFetch therefore fits MuddyWater’s established tradecraft of phishing-led initial compromise, staged payload delivery, defense evasion, and covert post-exploitation in support of regional espionage objectives.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The campaign delivered four novel malware families (CHAR, GhostFetch, GhostBackDoor, HTTP_VIP) against MENA targets via spearphishing.
The campaign delivered four novel malware families (CHAR, GhostFetch, GhostBackDoor, HTTP_VIP) against MENA targets via spearphishing.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
Defense Evasion: Obfuscation, reflective loading, disabling security tools, living-off-the-land (T1027, T1620, T1562).
Decimal-encoded строка хранится в UserForm1.TextBox1.Text - элементе формы, невидимом пользователю. Макрос считывает строку, декодирует и записывает PE-файл на диск.
Telegram как C2 - Web Protocols (T1071.001) - выбор со смыслом: TLS-шифрование, telegram.org нередко присутствует в whitelist корпоративных прокси.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A novel malware family delivered in Operation Olalampo via spearphishing against organizations in the MENA region.
A novel malware family delivered in Operation Olalampo against MENA targets via spearphishing.
First-stage loader that retrieves GhostBackDoor, uses HTTP C2, and copies itself with minor binary modifications for persistence and hash evasion.
A first-stage in-memory downloader used by MuddyWater in Operation Olalampo.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.