MuddyWater Launches RustyWater RAT in Spear-Phishing Campaign Targeting Middle East
- Securityish
- Threats & Incidents
Quick Summary
The Iranian threat actor MuddyWater has initiated a spear-phishing campaign targeting diplomatic, maritime, financial, and telecom sectors in the Middle East using a Rust-based implant known as RustyWater. This campaign employs malicious Word documents to deliver the RustyWater implant, which features capabilities like asynchronous command and control, registry persistence, and modular post-compromise expansion. The use of Rust-based malware marks a significant evolution in MuddyWater’s tactics, reflecting a shift from reliance on legitimate remote access software.
The Securityish Brief
MuddyWater, also known as Mango Sandstorm, Static Kitten, and TA450, has been operational since at least 2017 and is linked to Iran’s Ministry of Intelligence and Security (MOIS). The latest spear-phishing campaign, reported on January 10, 2026, targets various sectors, including diplomatic and financial entities, by delivering the RustyWater implant through emails disguised as cybersecurity guidelines. Victims are instructed to enable content in malicious Microsoft Word documents, which then execute a VBA macro to deploy the Rust implant binary.
RustyWater is designed to gather information from victim machines, detect security software, establish persistence via Windows Registry keys, and connect to a command-and-control server for file operations and command execution. The command-and-control server identified is “nomercys.it[.]com.” This campaign indicates a notable shift in MuddyWater’s approach, moving away from traditional PowerShell and VBS loaders to more sophisticated Rust-based implants.
In addition to RustyWater, MuddyWater has utilized various tools in its operations, including Phoenix, UDPGangster, BugSleep (also known as MuddyRot), and MuddyViper. The introduction of Rust-based malware signifies a strategic evolution towards more structured and less detectable remote access Trojan capabilities.
Implications for Cybersecurity
This development highlights the increasing sophistication of cyber threats, particularly from state-sponsored actors like MuddyWater. Organizations in the targeted sectors should be vigilant about phishing attempts, especially those that mimic legitimate communications. Users should be cautious when enabling content in documents from unknown sources, as this is a common tactic used to deploy malware.
Furthermore, the use of Rust for malware development suggests that organizations may need to enhance their defenses against newer programming languages that attackers are adopting. Regular updates to security software and awareness training for employees can help mitigate the risks associated with such advanced threats.
Monitoring for unusual activity and establishing robust incident response plans will be crucial for organizations to defend against potential breaches stemming from these types of attacks.
Key Takeaways
- Be cautious of emails that request enabling content in documents, especially from unknown sources.
- Regularly update your security software to protect against evolving threats like RustyWater.
- Implement employee training to recognize phishing attempts and suspicious communications.
- Establish an incident response plan to quickly address potential breaches.
- Monitor network activity for unusual behavior that may indicate a compromise.
Key Terms & Concepts
- RustyWater: In this article, RustyWater refers to a Rust-based implant used by the MuddyWater threat actor for cyber espionage.
- MuddyWater: MuddyWater is an Iranian hacking group linked to the Ministry of Intelligence and Security, known for targeting various sectors through cyber attacks.
- spear-phishing: Spear-phishing is a targeted attempt to steal sensitive information from specific individuals or organizations, often through deceptive emails.
- command-and-control server: A command-and-control server is a remote server that allows attackers to control compromised systems and manage malware operations.
Read the original article here: https://thehackernews.com/2026/01/muddywater-launches-rustywater-rat-via.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
