Loading malware…
RustyWater is a Rust-based remote access trojan associated with the Iranian threat actor MuddyWater, also tracked as Seedworm, Static Kitten, Mango Sandstorm, MERCURY, TA450, and TEMP.Zagros. It has been used in spearphishing campaigns targeting organizations in the Middle East, particularly diplomatic, maritime, financial, telecommunications, and government entities, with reporting also linking it to activity against Israeli and Iraqi targets and to broader pre-positioning operations.
RustyWater marks a notable evolution from MuddyWater’s historically PowerShell- and VBS-heavy tradecraft toward a more modular and lower-noise native implant. Delivery has been observed through weaponized Microsoft Word documents sent in phishing emails impersonating legitimate regional organizations. The documents rely on malicious VBA macros that decode an embedded payload and execute a Rust-compiled implant. Campaign reporting also notes icon spoofing and social-engineering themes such as cybersecurity guidance and official notices.
On infected Windows systems, RustyWater establishes persistence through Registry Run-key mechanisms, with some reporting indicating fallback from machine-wide to user-level persistence when privileges are insufficient. The malware performs extensive anti-analysis and defense-evasion checks, including discovery of antivirus and EDR products, virtual-machine and sandbox artifacts, debugger presence, low-resource environments, suspicious usernames, short uptime, and analysis-tool traces. Reported implementations include security-software discovery, anti-debugging logic, and process injection into explorer.exe to reduce visibility and support stealthier execution.
RustyWater communicates over HTTP using asynchronous Rust networking components and packages host metadata and task results in JSON. Reporting consistently describes layered obfuscation of command-and-control traffic and collected data using Base64 and XOR-based encoding or encryption, along with randomized sleep intervals, retry logic, and connection-management features intended to reduce detectability and improve resilience. Observed functionality includes host reconnaissance, command execution, file operations, and modular post-compromise activity, making it suitable for sustained espionage-oriented access rather than smash-and-grab intrusion. Public reporting has also linked this implant family or closely related variants to names such as Archer RAT and RUSTRIC.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MuddyWater (Iran) : malwares RustyWater et ZionSiphon contre Israël/Irak
28 distinct techniques documented for this family, organized by ATT&CK tactic.
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
The group's WMI-based persistence and memory-resident implant execution are specifically designed to evade the host-based detection tools most commonly deployed in government environments.
Execution & Persistence: PowerShell/PowerGoop, Rust-based implants (RustyWater/CHAR/Archer RAT), registry Run keys, scheduled tasks (T1059.001, T1547.001).
The client authenticates with a predefined ID and executes commands received from the server supporting both CMD and PowerShell commands.
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
Throughout, the macro itself is heavily obfuscated to dodge static detection... Data payloads are structured as JSON, then encoded in Base64 followed by a final XOR encryption layer to obfuscate traffic and complicate analysis.
WIRTE has used utilized look-alike domains and graphics of trusted security solution providers to entice victims to click on phishing links.
The final and most sophisticated capability is process injection into explorer.exe... Uses VirtualAllocEx... WriteProcessMemory... CreateRemoteThread...
Reddit.exe implements a comprehensive 8 layer anti-analysis system... scans the list of running processes looking for familiar names associated with virtualization software... checks the MAC address against known vendor prefixes used by virtualization software.
It searches for registry keys associated with debugging and monitoring software like Wireshark, Process Hacker, OllyDbg, and IDA Pro.
Credential Access & Collection: Browser credential dumping, system info gathering (T1555.003, T1082).
Reddit.exe implements a comprehensive 8 layer anti-analysis system... scans the list of running processes looking for familiar names associated with virtualization software... checks the MAC address against known vendor prefixes used by virtualization software.
Data payloads are structured as JSON, then encoded in Base64 followed by a final XOR encryption layer to obfuscate traffic and complicate analysis.
“most commonly rely on application layer protocols (T1071), such as HTTP …” and multiple groups use HTTPS/Discord/Telegram/DoH/MQTT.
C2 infrastructure: relies on HTTP protocol for all communications... Final result: (Actual payload connect to BEAR-C2 server) This payload establishes an HTTP connection to a remote server for command execution.
Sub DownloadAndRun: This is the download manager of the payload responsible for reaching out to the internet and pulling down the file... downloads the file in binary format. Once the download completes successfully the code saves the file... and immediately triggers its execution.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware used by MuddyWater in operations targeting Israel and Iraq.
Rust-based remote access trojan reportedly associated with Seedworm's evolving toolset.
Rust-based remote access implant delivered via phishing document and obfuscated VBA macro. It uses anti-analysis checks, registry persistence, process injection into explorer.exe, and HTTP C2 with JSON, Base64, and XOR-obfuscated communications for command execution and data exfiltration.
Malware/tool involved in phishing activity using impersonation of TMCell, Turkmenistan's primary mobile operator.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.