MuddyWater Uses Phishing, RMM Tools and Rust Malware in Middle East Campaigns

Article Details

Attack Vectors

• Spear-phishing emails delivered malicious Word documents disguised as business materials, government requests, diplomatic invitations, or cybersecurity guidance.
• Blurred document content and enable-content prompts persuaded recipients to activate VBA macros, which reconstructed and executed embedded payloads.
• A university-targeting document used an OpenXML attachedTemplate relationship to load a remotely hosted attacker-controlled template.
• HTML attachments and embedded links routed recipients through Dropbox and OneDrive to ZIP archives containing signed RMM installers.
• Legitimate RMM agents were delivered through phishing attachments or download links to enroll victim endpoints into attacker-operated management accounts.
• An Israel university attack delivered a password-protected RAR archive containing a signed Atera installer, obstructing static inspection of the attachment.
• Recent documents concealed encoded executable data in UserForm controls, wrote PE files with .log or .ini extensions, and executed them through WMI or command-shell mechanisms.
• A loader decrypted an embedded Rust payload using a repeated XOR key and executed the restored payload in memory.

Defensive Notes

• The article recommends endpoint behavior-based detection and correlation rather than relying solely on perimeter, email, document, or signature-based defenses.
• Monitor Office processes creating executable payloads, including files with misleading .log or .ini extensions, and correlate creation with subsequent execution.
• Correlate document execution with WMI activity, command-shell execution, system enumeration, security-product discovery, and external network connections.
• Monitor anomalous C2 destinations and periodic communication patterns following document execution.
• Distinguish authorized remote administration from suspicious installation and enrollment of legitimate RMM agents; signed installers and official service traffic do not establish benign intent.
• The article notes that legacy Office environments and users explicitly enabling macros can undermine macro-blocking protections.
• Genians claims that Genian Insights E detects anomalous document-to-payload process relationships, C2 connections, and reconnaissance activity.