# MuddyWater Operation Olalampo — Iran MOIS-Nexus APT Deploys New Malware Variants with Telegram Bot C2 Targeting Middle Eastern Governments and Critical Infrastructure

> Group-IB has disclosed Operation Olalampo, a cyber espionage campaign by MuddyWater (Mercury/Mango Sandstorm/Static Kitten/TEMP.Zagros/Seedworm/TA450/Earth Vetala), an Iranian APT group subordinate to the Ministry of Intelligence and Security (MOIS). The campaign deploys new malware variants leveraging Telegram Bot API for command-and-control, evolving the group's Small Sieve tradecraft with enhanced capabilities targeting Middle Eastern government and critical infrastructure organizations.

- **Published:** 2026-02-28T06:51:00Z
- **Last reviewed:** 2026-02-28T06:51:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0158
- **ID:** TL-2026-0158
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-0199, CVE-2020-0688, CVE-2020-1472

## Description

Group-IB published research on February 20, 2026 disclosing Operation Olalampo, a new offensive campaign by MuddyWater — one of the most prolific Iranian APT groups, confirmed by the FBI, CISA, U.S. Cyber Command CNMF, and the UK NCSC as a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Active since approximately 2018, MuddyWater has conducted broad cyber espionage campaigns in support of MOIS intelligence collection objectives across Asia, Africa, Europe, and North America.

Operation Olalampo represents an evolution of MuddyWater's tooling, deploying new malware variants that leverage Telegram Bot API as primary command-and-control infrastructure. This C2 channel is not entirely novel for the group — their Small Sieve backdoor (a Python-based implant documented in joint CISA/NCSC-UK advisory AA22-055A) already used Telegram Bot API over HTTPS with hex byte-swapping and obfuscated Base64 encoding for beacons and tasking. However, Operation Olalampo introduces updated variants with enhanced capabilities, likely addressing operational security deficiencies identified in the original Small Sieve exposure.

MuddyWater's attack chain historically follows a consistent pattern: spearphishing emails with malicious attachments (Excel macros, PDF droppers, or document files) or links to file-sharing services (OneHub, Sync, TeraBox) deliver initial payloads. The group is known for heavy reliance on PowerShell-based tooling (POWERSTATS backdoor), living-off-the-land techniques using system binaries (CMSTP.exe, mshta.exe, rundll32.exe), and DLL side-loading for defense evasion. Their malware suite includes PowGoop (DLL loader + PowerShell downloader disguised as Google Update), Small Sieve (Telegram Bot C2), Canopy/Starwhale (WSF-based collector), Mori (DNS tunneling backdoor), and POWERSTATS (PowerShell persistence backdoor).

The group maintains persistence through Registry Run keys, scheduled tasks, Office template macros, and DLL side-loading. For credential access, they deploy Mimikatz, LaZagne, procdump64.exe, and Browser64. Lateral movement leverages legitimate remote access tools including ConnectWise (ScreenConnect), RemoteUtilities, and SimpleHelp. Data exfiltration occurs over C2 channels using Base64 and XOR encoding.

MuddyWater has historically exploited CVE-2017-0199 (Office), CVE-2020-0688 (Exchange memory corruption), and CVE-2020-1472 (Netlogon/ZeroLogon) for initial access and privilege escalation. Their targeting focuses on government agencies, telecommunications providers, defense contractors, energy sector organizations, and oil and gas companies — particularly in the Middle East and Central/South Asia.

This is the first Iran-nexus APT threat on the Threadlinqs Intelligence Platform, adding a critical new nation-state dimension to platform coverage alongside existing China (4 threats), North Korea (5 threats), Russia, and Belarus clusters.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1047 Windows Management Instrumentation
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1137.001 Office Template Macros
- T1548.002 Bypass User Account Control
- T1027.010 Command Obfuscation
- T1036.005 Match Legitimate Resource Name or Location
- T1218.005 Mshta
- T1574.001 DLL
- T1480 Execution Guardrails
- T1003.001 LSASS Memory
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1057 Process Discovery
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1132.001 Standard Encoding
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1583.006 Web Services
- T1588.002 Tool

## Sources

- [Group-IB: Operation Olalampo — Inside MuddyWater's Latest Campaign](https://www.group-ib.com/blog/muddywater-operation-olalampo/)
- [CISA Advisory AA22-055A — Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a)
- [MITRE ATT&CK — MuddyWater (G0069)](https://attack.mitre.org/groups/G0069/)
- [NCSC-UK Malware Analysis Report — Small Sieve](https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-Small-Sieve.pdf)
- [U.S. Cyber Command — Iranian Intel Cyber Suite of Malware Uses Open Source Tools](https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/)
- [Group-IB: MuddyWater C2 Infrastructure Analysis](https://www.group-ib.com/blog/muddywater-infrastructure/)
- [CISA MAR-10369127 — MuddyWater Malware Analysis](https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-055a)
- [Trend Micro — Earth Vetala: MuddyWater Continues to Target Organizations](https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html)
- [Kaspersky — MuddyWater Technical Analysis](https://securelist.com/muddywater/88059/)
- [Palo Alto Unit42 — Muddying the Water: Targeted Attacks in the Middle East](https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/)
- [SentinelOne Intelligence Brief: Iranian Cyber Activity Outlook (Post-Airstrike Assessment)](https://www.sentinelone.com/blog/sentinelone-intelligence-brief-iranian-cyber-activity-outlook/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0158