RustyWater Rising: MuddyWater Drops PowerShell for Stealthy Rust Implants

The MuddyWater APT group has overhauled its arsenal, abandoning traditional scripting tools in favour of a stealthier Rust-based implant, as outlined in a CloudSEK TRIAD report. The operation targets diplomatic, maritime, financial, and telecom entities in the Middle East, marking a shift from PowerShell and VBS loaders to Rust for cross‑platform capabilities and lower detection rates.

The infection chain begins with spearphishing emails carrying malicious Word documents, with lure subject lines such as “New Cybersecurity Guidelines.” A dropper paves the way to the RustyWater implant, which CloudSEK describes as capable of asynchronous C2, anti‑analysis, registry persistence, and modular post‑compromise capability expansion.

While MuddyWater is often associated with Iranian interests, the report stresses that this Rust variant is distinct, and to avoid confusion the researchers refer to it as RustyWater throughout. According to CloudSEK’s TRIAD team, organisations in the targeted regions should update defenses beyond traditional IOCs to counter the raised stealth and resilience of this Rust-based tooling.