Reborn in Rust: MuddyWater Evolves Tooling with RustyWater Implant

MuddyWater APT group has launched a spearphishing campaign targeting various sectors in the Middle East, including diplomatic, maritime, financial, and telecom entities. The campaign employs icon spoofing and malicious Word documents to deliver a Rust-based implant dubbed 'RustyWater'. This new tool represents a significant upgrade from their traditional PowerShell and VBS loaders, offering capabilities such as asynchronous C2, anti-analysis features, registry persistence, and modular post-compromise expansion. The attack chain involves a malicious email with an attached document that triggers a multi-stage process, ultimately leading to the deployment of the RustyWater implant. This evolution in MuddyWater's toolkit demonstrates their adaptation to more sophisticated, structured, and stealthy attack methods.

• UNG0801: Tracking Threat Clusters obsessed with AV Icon Spoofing targeting IsraelMalware2025-12-22
• MATCHBOIL: New tricks, same old evil intentionsMalware2026-10-09
• One leftover build path links an infostealer, a remote-access tool, and a ransomware familyMalware2026-09-01
• Supply Chain Attack on arrayref: Significant Overlap with DPRK CampaignsMalware2026-08-20
• Popular Rust Crates Compromised in Build-Time Supply Chain AttackMalware2026-08-20