MalwarePublished 23 Feb 2026Updated 25 Mar 2026

Operation Olalampo: Inside MuddyWater's Latest Campaign

Source AlienVault OTX General

Description

MuddyWater APT has launched Operation Olalampo, targeting organizations in the MENA region. The campaign involves new malware variants, including a Rust backdoor called CHAR, downloaders GhostFetch and HTTP_VIP, and an advanced backdoor GhostBackDoor. Notably, the group is using Telegram bots for command-and-control, revealing insights into their post-exploitation tactics. The operation, first observed on January 26, 2026, shows tactical and technical overlaps with previous MuddyWater activities. Key discoveries include potential AI-assisted malware development and infrastructure reuse dating back to October 2025. The campaign aligns with ongoing geopolitical tensions and provides valuable information on the threat actor's evolving techniques.

Impact

The primary impact of Operation Olalampo is espionage and unauthorized data access, potentially compromising sensitive governmental, industrial, and strategic information within the MENA region. The use of advanced malware and stealthy C2 channels like Telegram bots enables prolonged undetected access, increasing the risk of extensive data exfiltration and intellectual property theft. Organizations may experience operational disruptions if malware components interfere with system stability or if incident response activities require system quarantines. The campaign’s AI-assisted malware development hints at rapidly evolving threats that could bypass traditional detection mechanisms, raising the difficulty and cost of defense. While the campaign currently appears regionally focused, the reuse of infrastructure and modular malware design could allow expansion or collateral impact beyond initial targets. The geopolitical context suggests that affected organizations may face targeted attacks aligned with regional conflicts or intelligence gathering efforts, amplifying the strategic consequences of successful intrusions.

Defensive guidance

Organizations should implement targeted detection rules for the specific malware variants CHAR, GhostFetch, HTTP_VIP, and GhostBackDoor, including behavioral analytics to identify unusual process execution and network traffic patterns associated with Telegram bot communications. Network defenders should monitor and restrict unauthorized use of Telegram and similar messaging platforms for C2 traffic, employing deep packet inspection and anomaly detection. Endpoint detection and response (EDR) solutions should be tuned to detect Rust-based malware signatures and suspicious downloader activities. Incident response teams must investigate any signs of infrastructure reuse or overlapping indicators with previous MuddyWater campaigns. Employing threat hunting focused on MITRE ATT&CK techniques observed in this campaign (e.g., credential dumping, process injection, scheduled task abuse) can uncover latent infections. Organizations should also enforce strict access controls, multi-factor authentication, and network segmentation to limit lateral movement. Sharing threat intelligence with regional CERTs and industry groups will enhance collective defense. Given the potential AI-assisted malware, investing in advanced machine learning-based detection tools and continuous monitoring is advisable. Finally, regular security awareness training should include information on social engineering tactics that may facilitate initial access.

Indicators of compromise

Domains 4

codefusiontech.org
jerusalemsolutions.com
miniquest.org
promoverse.org

IP addresses 4

143.198.5.41
162.0.230.185
209.74.87.100
209.74.87.67

Hashes 61

0f839cafa6565f74303e5e5f414f9d8c
2533307ec1ef8b0611c8896e1460b076
64af4e6216026ed8fcfbf8b07ee20707
bb3587d3da3fbe4ab8c36721d9435327
c6160e69af601077892cbc669bc00926
dc706b45a9e6770ae327adff4ccd1a7e
f5ef5f40922113c2dfb32c202ae2b3f5
f96e2225af8dbf7555f3f4669d685d41
0365daf83e37d2c6daaae6c28b4c8343288ef2f9
0588cf26b6e9210f86a266ac0366af1fd29f135c

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Feb 2026, 10:33 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 4

IP addresses 4

Hashes 61

Community reviews

Related threats