MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors

The Iranian threat actor known as MuddyWater has been attributed to a spear-phishing campaign targeting diplomatic, maritime, financial, and telecom entities in the Middle East, delivering a Rust-based implant codenamed RustyWater. According to CloudSEK, the campaign uses icon spoofing and malicious Word documents to deliver RustyWater implants capable of asynchronous C2, anti-analysis, registry persistence, and modular post‑compromise capability expansion.

The operation has been ongoing since at least 2017 and is also tracked under names such as Mango Sandstorm, Static Kitten, and TA450, with alleged affiliation to Iran's MOIS. Attack chains involve spear-phishing emails masquerading as cybersecurity guidelines that instruct recipients to enable content to execute a malicious VBA macro deploying the Rust implant binary.

RustyWater is described as gathering information about the victim, detecting installed security software, establishing persistence via a Windows Registry key, and contacting a C2 server at nomercys[.]it[. ]com to facilitate file operations and command execution. It has also been referred to as Archer RAT and RUSTRIC, and Seqrite Labs flagged the RUSTRIC usage in related campaigns.