MuddyWater Adopts Rust-Based RustyWater Implant in Middle East Espionage Campaign

A sophisticated phishing campaign delivered a new type of malware, called RustyWater, to targets across the Middle East. This malware is used to spy on victim systems and maintain long-term access.

The campaign has been attributed to Muddy Water, a known state-backed hacking group linked to Iran. They are also known as Static Kitten or Mango Sandstorm.

The primary goal appears to be espionage — silently collecting information from diplomatic, telecom, maritime, and financial entities, as well as maintaining long-term system access.

Attackers used fake emails impersonating official institutions. Victims who opened the attached Word file unknowingly executed malicious code that installed the RustyWater malware.

Unlike earlier tools used by this group, RustyWater is written in Rust, making it stealthier and more modular. It can expand its spying capabilities over time without being easily detected.

Organizations in UAE, Turkmenistan, and other Middle Eastern countries were targeted, including financial institutions, government agencies, and telecom providers.

These sectors often hold sensitive geopolitical, economic, or diplomatic data, making them valuable targets for state-backed cyber operations.

Be cautious with unexpected email attachments, especially from unknown senders. Implement endpoint monitoring, watch for suspicious registry changes, and inspect unusual network activity like repeated failed connections or encrypted traffic from unknown processes.