GhostBackDoor
GhostBackDoor is a second-stage backdoor associated with the Iranian state-linked threat actor MuddyWater (also tracked as Seedworm, Earth Vetala, Mango Sandstorm, MUDDYCOAST, TEMP.Zagros, TA450, and G0069). It was documented in MuddyWater’s Operation Olalampo campaign, first observed on January 26, 2026, which primarily targeted organizations and individuals across the Middle East and North Africa, with additional reporting tying related activity to sectors including diplomatic, maritime, energy, finance, telecom, and other critical infrastructure, including a UAE marine and energy company. In the reported attack chains, GhostBackDoor is delivered by the GhostFetch first-stage downloader, typically following phishing emails with malicious Microsoft Office attachments and macro-enabled lure documents; reporting also notes MuddyWater exploited recently disclosed vulnerabilities on public-facing servers for initial access in the broader campaign. GhostBackDoor is described as a persistent post-exploitation implant and secondary payload that provides interactive shell or remote command execution, file read/write and broader file manipulation capabilities, and the ability to re-run GhostFetch to fetch additional payloads. Multiple sources characterize it as an advanced backdoor or secondary implant used to maintain persistent access after initial compromise. High-confidence related malware and tooling mentioned alongside GhostBackDoor in the same campaign include GhostFetch, HTTP_VIP, CHAR, AnyDesk, Nuso, UDPGangster, LampoRAT, RustyWater, Phoenix, and Fooder loader. No specific GhostBackDoor file hashes, mutexes, domains, or other unique IOCs were provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
...the threat actor is said to have conducted four distinct waves of attack, leading to the deployment of various malware families, including GhostBackDoor and Nuso... | CVE-2025-54068 (CVSS score: 9.8) - A code injection vulnerability in Laravel Livewire that could allow unauthenticated attackers to achieve remote command execution in specific scenarios. (Fixed in July 2025)
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MuddyWater's Operation Olalampo deployed GhostFetch as a first-stage in-memory downloader, HTTP_VIP as a Windows-native downloader using hardcoded C2s for AnyDesk RMM delivery, GhostBackDoor for persistent post-exploitation C2...
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
1 technique
Credential Access
Discovery
1 technique
Discovery
Command and Control
3 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor malware deployed by MuddyWater during a sustained campaign against a UAE marine and energy company.
A persistent post-exploitation backdoor/C2 component used by MuddyWater.
A backdoor deployed in the GhostFetch execution chain during Operation Olalampo.
A MuddyWater-associated backdoor family referenced as part of a January campaign leveraging phishing and Telegram-based C2 for covert access and persistence.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.