20260110-thehackernews.com-31f19 | Perceptive Security

< Back to index

MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors

Published:

10 January 2026 at 10:35:00

Alert date:

10 January 2026 at 11:01:12

Source:

thehackernews.com

Ransomware & Malware, Email & Messaging, Data Breach & Exfiltration

Iranian threat actor MuddyWater launched a spear-phishing campaign targeting diplomatic, maritime, financial, and telecom entities in the Middle East. The campaign deploys a new Rust-based implant called RustyWater RAT through malicious Word documents with icon spoofing. The malware features asynchronous C2 communication, anti-analysis capabilities, registry persistence, and modular architecture. This represents an active campaign by a known state-sponsored threat group targeting critical infrastructure sectors.

Technical details

MuddyWater is conducting spear-phishing campaigns using malicious Word documents with icon spoofing. The attack chain involves emails masquerading as cybersecurity guidelines with attached Word documents that prompt victims to 'Enable content' to activate VBA macros. These macros deploy the RustyWater (also called Archer RAT and RUSTRIC) Rust-based implant. The malware performs victim machine reconnaissance, detects security software, establishes persistence via Windows Registry keys, and communicates with C2 servers for file operations and command execution. The implant features asynchronous C2 communication, anti-analysis capabilities, registry persistence, and modular post-compromise expansion capabilities.

Mitigation steps:

Monitor for spear-phishing emails masquerading as cybersecurity guidelines with Word document attachments. Implement controls to prevent VBA macro execution from untrusted documents. Monitor Windows Registry for unauthorized persistence mechanisms. Implement network monitoring for communications to suspicious domains. Deploy anti-malware solutions capable of detecting Rust-based implants.

Affected products:

Microsoft Word

Related CVE's:

Related threat actors:

IOC's:

nomercys.it[.]com, RustyWater, Archer RAT, RUSTRIC

This article was created with the assistance of AI technology by Perceptive.