Loading story…
The Iran-linked MuddyWater advanced persistent threat (APT) group has shifted tactics by deploying a new malware family dubbed RustyWater, which is implemented in the Rust programming language. This marks a departure from their previous reliance on PowerShell-based payloads, with the new Rust-based implants designed to enhance stealth and evade detection. Security researchers have identified these implants being used in targeted attacks against organizations in Israel and other Middle Eastern countries.
The adoption of Rust for malware development by MuddyWater demonstrates an evolution in their tradecraft, likely aimed at bypassing traditional security controls that more readily detect PowerShell activity. The campaign highlights the ongoing threat posed by state-aligned actors in the region and underscores the need for organizations to update detection mechanisms to account for emerging malware written in less common languages such as Rust.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Security reporting on the campaign highlighted MuddyWater's move away from PowerShell toward a stealthier, more modular Rust-based implant. Researchers said the new malware supports asynchronous C2, anti-analysis checks, system reconnaissance, file operations, and command execution.
When victims enabled content in the booby-trapped Word documents, a VBA macro deployed a newly identified Rust-based implant called RustyWater. The malware established Windows Registry persistence and communicated with a command-and-control server at nomercys.it[.]com.
An Iran-linked MuddyWater operation targeted critical organizations across the Middle East, including diplomatic, maritime, financial, and telecommunications entities. The campaign used icon spoofing and malicious Microsoft Word documents that lured victims into enabling content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecsoonline.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iranian state-linked threat group **MuddyWater** targeted governments, ministries, universities, telecommunications providers, and other organizations in Turkey, the Arabian Peninsula, Pakistan, Armenia, and nearby countries with evolving espionage malware campaigns. Researchers said the group delivered malicious Excel and Office documents through phishing, using macros and the Office exploit `CVE-2017-0199` to launch multi-stage infections that dropped Windows Script Files, persistence components, and remote access tools including **SloughRAT**—also tracked as **Canopy**—along with additional Visual Basic and JavaScript implants. The intrusion chains used compromised or attacker-controlled infrastructure, regional decoy themes tied to Tajikistan, Pakistan, and Kurdistan, and fallback behavior that sometimes redirected victims to benign sites when command-and-control failed. Cisco Talos and Clearsky reported that MuddyWater combined PowerShell, living-off-the-land binaries, DNS and HTTP command-and-control, token-tracking mechanisms, and staged payload retrieval to execute arbitrary commands on victim systems, underscoring a broader shift toward more flexible and advanced tradecraft aligned with Iranian intelligence objectives.
Aug 14, 2026
A joint U.S.-U.K. advisory warned that the Iran-linked APT group **MuddyWater**, tied to Iran’s Ministry of Intelligence and Security, is targeting government and private-sector organizations across Asia, Africa, Europe, and North America. The campaign has hit sectors including telecommunications, defense, local government, and oil and natural gas, with operators using spear-phishing, exploitation of known Microsoft flaws such as `CVE-2020-1472` and `CVE-2020-0688`, open-source tooling, and a broad malware arsenal including **PowGoop**, **Small Sieve**, **Canopy/Starwhale**, **Mori**, and **POWERSTATS** for delivery, persistence, command and control, and data theft. The warning aligns with years of reporting that MuddyWater has run espionage operations using macro-laced lure documents, staged PowerShell payloads, LOLBins such as `rundll32.exe` and `mshta.exe`, scheduled tasks, and compromised domains to infect targets in the Middle East and beyond, including Lebanon and Oman. Researchers have also linked the group to more disruptive activity, including the **DarkBit** ransomware campaign, indicating that MuddyWater’s operations now span both intelligence collection and destructive or coercive attacks; agencies urged organizations to strengthen cyber hygiene, patch exposed systems, and apply tighter application controls to reduce risk.
Aug 15, 2026
Security researchers and government analysts said the Iranian state-linked **MuddyWater** group continued broad cyberespionage operations across the Middle East and nearby regions while evolving its malware and command-and-control infrastructure. Recent reporting tied the actor to a previously unreported Go-based C2 framework, **MuddyC2Go**, which appears to have replaced older **PhonyC2** infrastructure after source code leaks and has been active since at least 2020. Campaigns linked to the framework targeted a Jordanian company, an Iraqi telecommunications provider, and likely Israeli organizations, while earlier activity hit government, telecom, and intergovernmental entities in Turkey, Jordan, Iraq, Georgia, Azerbaijan, Armenia, Pakistan, and other regional states through spearphishing, malicious archives, macro-enabled Office files, PDFs, and PowerShell-heavy loaders. Across multiple campaigns, MuddyWater used a shifting toolset that included **POWGOOP**, **Canopy/Starwhale**, **Mori**, **ForeLord**, **POWERSTATS**, **Covicli**, lightweight VBS first-stage malware, DNS-tunneling RATs, ASP.NET web shells, and tunneling utilities such as **SSF** and **Ligolo**. Analysts also linked the group to exploitation of **`CVE-2020-0688`** and possible use of **`CVE-2020-1472`** in operations against Israeli targets, including an intrusion assessed as potentially destructive through deployment of PowGoop and a Thanos-based wiper-like payload disguised as ransomware. Despite changes in malware families and infrastructure, reports consistently described the actor as relying heavily on **PowerShell**, credential theft, persistence via registry keys or scheduled tasks, and rapidly changing C2 servers, underscoring a sustained Iranian espionage capability with occasional escalation toward disruptive effects.
Aug 15, 2026