DNS Analysis Expands IoCs Linked to MuddyWater’s Operation Olalampo

Summary

A DNS/WHOIS investigation of Group-IB IoCs for the MuddyWater-attributed Operation Olalampo linked 10 potential victim IPs, 2,530 email-associated domains, six additional malicious IPs and 55 string-connected domains; the authors urge corroboration.

Key points

Group-IB’s initial network IoC set comprised four domains and three IP addresses associated with Operation Olalampo.
Sample network data showed 10 unique potential victim IP addresses communicating with an IoC between Jan. 25 and Feb. 25, 2026.
A public email address found in historical WHOIS records for the IoC domains was used to identify 2,530 email-connected domains.
DNS lookups found six additional IP addresses, which the article says threat-intelligence queries identified as previously weaponized.
The analysis also identified 55 string-connected domains.
The four domain IoCs were created between Oct. 28, 2025, and Feb. 2, 2026; the article says they were administered by Namecheap and registered in Iceland.
The authors caution that entities labeled as threats may later prove harmless and recommend further investigation.

Article Details

Attack Vectors: MuddyWater targeted organizations and individuals primarily across the MENA region using new malware variants.
Telegram bots were used for command-and-control communications.
Defensive Notes: The article recommends conducting supplementary investigations to corroborate entities identified as threats.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`codefusiontech[.]org`	Identified as a network IOC for Operation Olalampo.
DOMAIN	`jerusalemsolutions[.]com`	Identified as a network IOC for Operation Olalampo.
DOMAIN	`miniquest[.]org`	Identified as a network IOC for Operation Olalampo.
IPV4	`162[.]0[.]230[.]185`	Identified as a network IOC for Operation Olalampo.
IPV4	`209[.]74[.]87[.]100`	Identified as a network IOC for Operation Olalampo.