Group-IB Links Operation Olalampo Espionage Campaign to MuddyWater

Summary

Group-IB attributes Operation Olalampo, first observed January 26, 2026, to MuddyWater. The MENA-focused campaign uses four newly identified malware families, including Rust-based CHAR, and a Telegram bot for C2; researchers also report signs of AI-assisted development.

Key points

Group-IB attributes Operation Olalampo, first observed January 26, 2026, to MuddyWater and says it targets organizations and individuals in the MENA region.
Researchers identified four previously unknown malware families: CHAR, GhostBackDoor, GhostFetch, and HTTP_VIP.
CHAR is a Rust backdoor; GhostFetch and HTTP_VIP are described as downloaders, while GhostBackDoor is designed for persistence.
One malware variant uses a Telegram bot for command-and-control; monitoring it provided insight into post-exploitation activity, including commands and deployed tools.
Group-IB reports indicators of AI-assisted malware development, but the article does not detail the evidence.
Researchers cite code or tradecraft overlaps with earlier MuddyWater-linked malware, including BlackBeard, also known as Archer RAT.

Article Details

Event Type: Cyber-espionage campaign attributed to MuddyWater, using novel malware and a Telegram bot for command and control.
Impact: Organizations and individuals across the MENA region were targeted. The campaign involved four previously unknown malware families and post-exploitation activity; the source does not report specific victim losses or confirmed data theft.

Threat Actors

MuddyWaterThe campaign is attributed to MuddyWater. The source reports tactical and technical overlap with prior activity attributed to the group, but does not describe attribution as independently confirmed.

Malware

Archer RATDespite new Rust tooling and variants, the malware shows tradecraft and code overlaps with prior MuddyWater activity such as BlackBeard/Archer RAT.BlackBeardDespite new Rust tooling and variants, the malware shows tradecraft and code overlaps with prior MuddyWater activity such as BlackBeard/Archer RAT.CHARThe campaign deploys four novel malware families—CHAR, GhostBackDoor, GhostFetch, and HTTP_VIP—shows signs of AIâassisted development, and leverages a Telegram bot for commandâandâcontrol.GhostBackDoorThe campaign deploys four novel malware families—CHAR, GhostBackDoor, GhostFetch, and HTTP_VIP—shows signs of AIâassisted development, and leverages a Telegram bot for commandâandâcontrol.GhostFetchThe campaign deploys four novel malware families—CHAR, GhostBackDoor, GhostFetch, and HTTP_VIP—shows signs of AIâassisted development, and leverages a Telegram bot for commandâandâcontrol.HTTP_VIPThe campaign deploys four novel malware families—CHAR, GhostBackDoor, GhostFetch, and HTTP_VIP—shows signs of AIâassisted development, and leverages a Telegram bot for commandâandâcontrol.

Products

TelegramThe campaign deploys four novel malware families—CHAR, GhostBackDoor, GhostFetch, and HTTP_VIP—shows signs of AIâassisted development, and leverages a Telegram bot for commandâandâcontrol.