MuddyWater Uses RustyWater Implant in Middle East Spearphishing Campaign
Summary
CloudSEK analyzes a MuddyWater-attributed spearphishing campaign targeting Middle Eastern sectors with malicious Word documents that deliver a Rust implant featuring registry persistence, asynchronous C2, evasion, and process injection.
Key points
- The campaign targeted diplomatic, maritime, financial, and telecom organizations across the Middle East.
- A spearphishing email with a malicious Word document used VBA macros to decode and execute a payload.
- The Rust implant, dubbed RustyWater, gathers victim-system information and scans for more than 25 antivirus and EDR products.
- It establishes persistence through a Windows Run registry key and communicates with HTTP-based C2 using encrypted, encoded JSON and randomized callback delays.
- The malware can inject code into explorer.exe using remote memory allocation and process-memory writing.
- CloudSEK attributes the activity to MuddyWater with high confidence, citing code reuse, targeting patterns, and tactical similarities.
- Recommended defenses include monitoring unusual Run-key writes, jittered outbound HTTP, and process-injection behavior.
Article Details
- Attack Vectors
- Spearphishing emails with a malicious Cybersecurity.doc attachment delivered a Rust-based implant.
- The Word document used VBA macros to decode and write a PE payload as CertificationKit.ini under C:\ProgramData\, then execute it.
- The implant used HTTP command-and-control, randomized callback delays, and process injection targeting explorer.exe.
- Defensive Notes
- Monitor anomalous writes to user-context Windows Run registry keys, especially entries referencing .ini or PE artifacts in C:\ProgramData\.
- Detect retry-heavy outbound HTTP, randomized callback intervals, fallback domains, and layered JSON-to-Base64-to-XOR transformations.
- Hunt for VirtualAllocEx, WriteProcessMemory, and thread-context manipulation involving benign processes such as explorer.exe.
- Flag signed binaries launched from writable paths when followed by unsigned module loads or remote thread creation.
- Monitor transitions from passive beaconing to file listing, keylogging, credential harvesting, or task execution.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bootcamptg[.]org | Domain reported as resolving to a listed malicious infrastructure IP. |
| DOMAIN | nomercys[.]it[.]com | Domain reported as resolving to a listed malicious infrastructure IP. |
| DOMAIN | stratioai[.]org | Domain reported as resolving to a listed malicious infrastructure IP. |
| IPV4 | 159[.]198[.]66[.]153 | Malicious infrastructure IP reported as resolving from nomercys[.]it[.]com. |
| IPV4 | 159[.]198[.]68[.]25 | Malicious infrastructure IP reported as resolving from stratioai[.]org. |
| IPV4 | 161[.]35[.]228[.]250 | Malicious infrastructure IP reported as resolving from bootcamptg[.]org. |
| SHA256 | 3d1e43682c4d306e41127ca91993c7befd6db626ddbe3c1ee4b2cf44c0d2fb43 | SHA256 hash listed for a cloud.exe malware artifact. |
| SHA256 | 42ad0c70e997a268286654b792c7833fd7c6a2a6a80d9f30d3f462518036d04c | SHA256 hash listed for an art.exe malware artifact. |
| SHA256 | 7523e53c979692f9eecff6ec760ac3df5b47f172114286e570b6bba3b2133f58 | SHA256 hash listed for the reddit.exe implant artifact. |
| SHA256 | 76aad2a7fa265778520398411324522c57bfd7d2ff30a5cfe6460960491bc552 | SHA256 indicator listed in the report's threat-intelligence indicators. |
| SHA256 | a2001892410e9f34ff0d02c8bc9e7c53b0bd10da58461e1e9eab26bdbf410c79 | SHA256 hash listed for an art.exe malware artifact. |
| SHA256 | c23bac59d70661bb9a99573cf098d668e9395a636dc6f6c20f92c41013c30be8 | SHA256 hash listed for an art.exe malware artifact. |
| SHA256 | ddc6e6c76ac325d89799a50dffd11ec69ed3b5341740619b8e595b8068220914 | SHA256 hash listed for an nginx.exe malware artifact. |
| SHA256 | e081bc408f73158c7338823f01455e4f5185a4365c8aad1d60d777e29166abbd | SHA256 hash listed for a cloud.exe malware artifact. |
| SHA256 | e61b2ed360052a256b3c8761f09d185dad15c67595599da3e587c2c553e83108 | SHA256 hash listed for an art.exe malware artifact. |
| SHA256 | f38a56b8dc0e8a581999621eef65ef497f0ac0d35e953bd94335926f00e9464f | SHA256 hash listed for the Cybersecurity.doc phishing attachment. |
MITRE ATT&CK
T1047 · Windows Management InstrumentationThe report's mapping states WMI Win32_Process.Create was used to execute CertificationKit.ini.T1059.005 · Visual BasicVBA macros in the Word document decoded and launched the payload.T1106 · Native APIThe report identifies use of native APIs including RegOpenKeyExW, GetUserNameW, GetComputerNameExW, and CreateWaitableTimerExW.T1204.002 · Malicious FileThe report describes the user opening the document, leading to payload drop and execution.T1566.001 · Spearphishing AttachmentSpearphishing email delivered the malicious Cybersecurity.doc attachment.T1620 · Reflective Code LoadingThe report maps decoding the hex-coded PE payload in memory to reflective code loading.
Threat Actors
Malware
Archer RATAlthough this Rust-based implant has appeared in limited reporting under names like Archer RAT / RUSTRIC, it remains far less documented than Muddy Water’s legacy PowerShell/VBS tooling. To avoid name collisions and forRustyWaterlegacy PowerShell/VBS tooling. To avoid name collisions and for sanity, we refer to this variant as RustyWater throughout this report
Products
Tools
oledumpOletools detects MacrosWe can run oleid to identify if any macros are present in the document and dump them further using tools like oledump.oleidOletools detects MacrosWe can run oleid to identify if any macros are present in the document and dump them further using tools like oledump.oletoolsOletools detects MacrosWe can run oleid to identify if any macros are present in the document and dump them further using tools like oledump.reqwest"reqwest/0.12.23" // Rust HTTP librarytokioC2 SetupThe binary also uses Rust's async runtime (tokio) with multiple threads to handle C2 communication, file operations, and command execution concurrently without blocking
Countries
Industries
Diplomaticattributed to the Muddy Water APT group targeting multiple sectors across the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign uses icon spoofing and malicious WordEducationUAE MOFA DecoyWe were able to find 5 more lures targeting UAE’s Financial and Education sectors.financialWater APT group targeting multiple sectors across the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign uses icon spoofing and malicious Word documents to deliver RustMaritimeto the Muddy Water APT group targeting multiple sectors across the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign uses icon spoofing and malicious Word documents toTelecommunications