- The Iranian state-sponsored hacking group MuddyWater has launched a new campaign called Operation Olalampo, deploying multiple new malware families.
- The group utilized AI-assisted development tools to create a Rust-based backdoor and targeted organizations in the Middle East and North Africa via malicious email attachments.
- Security researchers at Group-IB found the malware shares code with prior tools, indicating continuous evolution of the threat actor’s capabilities.
The Iranian cyber-espionage group MuddyWater has targeted entities across the Middle East and North Africa since late January 2026 with a sophisticated new malware suite, according to a report published by Group-IB. This campaign, codenamed Operation Olalampo, involves phishing emails with malicious documents that deploy a range of custom tools.
Consequently, the attack chains ultimately drop downloaders like GhostFetch and HTTP_VIP, which fetch advanced backdoors. One notable implant is a Rust-based backdoor named CHAR, which is controlled via a Telegram bot for remote command execution.
Meanwhile, a separate downloader variant leads to GhostBackDoor, granting attackers an interactive shell and file control. Analysts found that CHAR’s source code contains emojis in debug strings, suggesting “signs of artificial intelligence (AI)-assisted development”.
This finding aligns with previous observations that the group experiments with generative AI for malware creation. Furthermore, CHAR shares structural similarities with another Rust malware, BlackBeard, previously used by the same actor.
The group has also been observed exploiting recent vulnerabilities on public-facing servers for initial access. Group-IB concluded that the operation highlights MuddyWater’s dedication to expanding its technical capabilities and regional focus.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
