Genians Report Details MuddyWater’s Rust Payload and Macro-Based Attack Chain
Summary
A Genians report describes Middle Eastern APT campaigns, including a MuddyWater-attributed chain using RMM tools and a macro-enabled Word lure to run a disguised Rust payload that contacts a C2 server and inventories security products.
Key points
- Genians describes Middle Eastern state-sponsored APT activity focused on stealth and long-term intelligence collection.
- The report says these groups target governments and critical infrastructure across Europe, Asia, and North America.
- Social engineering, macro-enabled Word documents, and abuse of RMM tools are described as initial access methods.
- In a campaign attributed to MuddyWater, a macro-enabled document named Cybersecurity.doc runs a hidden command through WScript.Shell.
- The resulting Certificationkit.ini file is described as a 64-bit Rust executable named reddit.exe internally, with a Cloudflare icon.
- The payload reportedly contacts nomercys[.]it[.]com to enumerate installed security products and await instructions.
- The report warns that perimeter-based detection has limitations and emphasizes endpoint behavior-based detection.
Article Details
- Event Type
- A Genians report describes a campaign attributed to MuddyWater that uses a macro-enabled Word document to deliver a Rust-based payload and contact a command-and-control server.
- Impact
- The reported payload catalogs installed security products on compromised systems and awaits further instructions. The campaign targets governments and critical national infrastructure; no specific data loss or other victim impact is reported.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | nomercys[.]it[.]com | Identified as the command-and-control server contacted by the reported Rust-based payload. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe malware uses string obfuscation.T1059.003 · Windows Command ShellThe payload is launched through a hidden cmd.exe command.T1059.005 · Visual BasicThe article reports that enabling macros in the Word document starts the attack chain.T1204.002 · Malicious FileThe attack begins with a deceptive Word document; the victim must open it and enable macros.T1518.001 · Security Software DiscoveryThe payload catalogs the victim’s installed security products.