RustyWater Rising: MuddyWater Drops PowerShell for Stealthy Rust Implants

The notorious MuddyWater APT group has overhauled its arsenal, ditching its traditional scripting tools for a sophisticated new weapon built to evade detection. In a new report released by CloudSEK’s TRIAD research team, analysts have uncovered a targeted spearphishing campaign striking at the heart of the Middle East’s critical sectors using a never-before-seen malware variant dubbed “RustyWater.”

The campaign, which has zeroed in on “diplomatic, maritime, financial, and telecom entities,” marks a significant departure from the group’s established modus operandi.

For years, MuddyWater (often associated with Iranian interests) has been known for its reliance on “PowerShell and VBS loaders” to gain initial access to victim networks. However, this latest operation signals a strategic pivot toward more resilient and stealthy engineering.

“The introduction of Rust-based implants represents a notable tooling evolution toward more structured, modular, and low noise RAT capabilities,” the report states.

By moving to the Rust programming language, the attackers gain two key advantages: cross-platform compatibility and, more importantly, a lower detection rate against modern endpoint protection systems, which are often tuned to catch the group’s older scripting tricks.

The infection begins with a classic but effective spearphishing tactic. Victims receive emails containing malicious Word documents, often disguised as official communication. One observed lure bore the subject line “New Cybersecurity Guidelines” .

The kill chain is methodical:

1. Malicious Email: The victim receives the lure.
2. Malicious Macro: Opening the document triggers code execution.
3. Dropper: An intermediate executable (e.g., Cybersecurity.doc leading to nomercys.it.com downloads) paves the way.
4. Implant: The RustyWater implant is deployed, capable of “asynchronous C2, anti-analysis, registry persistence, and modular post-compromise capability expansion”.

While limited reporting has surfaced regarding Rust-based tools under names like “Archer RAT” or “RUSTRIC,” CloudSEK analysts emphasize that this specific variant is distinct.

“To avoid name collisions and for sanity, we refer to this variant as RustyWater throughout this report,” the researchers noted.

As the group continues to modernize its toolkit, organizations in the targeted regions are urged to look beyond traditional indicators of compromise and update their defenses against compiled malware threats.

Related Posts:

• MuddyWater APT Shifts Tactics to Custom Malware
• Iran-Linked MuddyWater Deploys Phoenix v4 Backdoor via Compromised Emails and NordVPN Exit Node
• Rust Lands in Windows 11 Kernel: A New Era for OS Security?
• Iran-Linked MuddyWater Deploys UDPGangster Backdoor, Using UDP Protocol for Covert C2
• DCHSpy Android Spyware Linked to Iran’s MuddyWater APT, Targets Geopolitical Foes with Starlink Lures