JUMPSEC Links Muddy Water to CastleRAT and ChainShell
Summary
JUMPSEC reports a direct operational link between Muddy Water infrastructure and TAG-150’s CastleRAT, describing ChainShell, HVNC browser-session access, smart-contract-based C2, and payloads compiled before Feb. 28.
Key points
- JUMPSEC reports a direct operational link between Muddy Water infrastructure and TAG-150, which operates the CastleRAT malware-as-a-service platform.
- Researchers found Farsi code comments and Israeli IP range lists on a misconfigured C2 server, which they cite as evidence of the actor's origin and targets.
- A reset.ps1 loader deploys ChainShell, which executes JavaScript received from the C2 server using Function().
- The report says HVNC can let operators access browser sessions and webmail while masquerading as the victim's session, potentially bypassing MFA without a new-login trace.
- ChainShell reportedly obtains its C2 address from an Ethereum smart contract, making the infrastructure more resistant to disruption.
- Researchers found two payloads hidden in steganographic JPEGs and compiled before Feb. 28; JUMPSEC describes this as consistent with pre-staged capability.
Article Details
- Attack Vectors
- The reset.ps1 loader deploys ChainShell, which executes raw JavaScript received from the C2 server using Function().
- HVNC enables invisible browser-session hijacking and access through the victim's existing session cookies.
- ChainShell resolves its C2 from an Ethereum smart contract.
- Native payloads were concealed in steganographic JPEG images.
MITRE ATT&CK
T1027.003 · SteganographyNative payloads were hidden inside steganographic JPEG images.T1059.001 · PowerShellThe reset.ps1 loader uses PowerShell to deploy ChainShell.T1059.007 · JavaScriptChainShell executes raw JavaScript received from the C2 server using Function().T1185 · Browser Session HijackingHVNC is described as enabling invisible browser-session hijacking.T1550.004 · Web Session CookieOperators use the victim's existing session cookies to access webmail and cloud infrastructure without a new-login trace.
Threat Actors
Malware
CastleRATnew alliance between Iranian threat actor Muddy Water and Russian-speaking cybercriminals operating the CastleRAT (TAG-150) MaaS, marking a capability upgrade from simple scripts to professional-grade intrusion tools.ChainShellThe group now deploys a JavaScript-based ChainShell via a reset.ps1 loader, uses HVNC for invisible browser session hijacking, and resolves C2 through an Ethereum smart contract, showing pre-staged deployments ahead of
Vendors
Products
Countries
IranThese were compiled just before the US and Israel attacked Iran on February 28th, a move JUMPSEC describes as “consistent with pre-staged capability ahead of anticipated escalation”.IsraelThese were compiled just before the US and Israel attacked Iran on February 28th, a move JUMPSEC describes as “consistent with pre-staged capability ahead of anticipated escalation”.