CHAR represents a significant evolution in MuddyWater's malware arsenal — a Rust-based backdoor marking the group's first known use of the Rust programming language for implant development. This language choice provides memory safety guarantees that complicate reverse engineering and exploitation of the implant itself, while also generating binaries that are harder for traditional signature-based detection to fingerprint due to Rust's unique compilation artifacts and standard library linking patterns. The campaign deploys a four-component malware suite: 1. **CHAR (Rust Backdoor)**: The primary implant, compiled in Rust with heavy string obfuscation and anti-analysis techniques. CHAR provides full remote access capabilities including command execution, file operations, process manipulation, and credential harvesting. The Rust implementation suggests deliberate investment in tooling modernization — MuddyWater historically relied on PowerShell (POWERSTATS), Python (Small Sieve, Out1), and .NET payloads. 2. **GhostFetch (Downloader)**: A lightweight first-stage downloader responsible for initial beacon and payload retrieval. GhostFetch establishes initial C2 contact and downloads the CHAR implant or other second-stage payloads. Uses HTTP/HTTPS with custom User-Agent strings and encoded beacon parameters. 3. **HTTP_VIP (Downloader)**: An alternative first-stage downloader with HTTP-based C2, featuring anti-sandbox checks (timing-based execution delays, environment fingerprinting) before payload delivery. HTTP_VIP checks for virtualization indicators, debugger presence, and sandbox artifacts before proceeding with download operations. 4. **GhostBackDoor (Advanced Backdoor)**: A secondary backdoor providing redundant access with additional capabilities including screenshot capture, keylogging, and browser credential theft. GhostBackDoor serves as a persistence mechanism if the primary CHAR implant is detected and removed. **Telegram Bot C2 Channel**: The campaign uses Telegram Bot API as a C2 channel — a direct evolution from MuddyWater's Small Sieve backdoor (documented in NCSC-UK MAR and CISA AA22-055A). Small Sieve used Telegram Bot API over HTTPS with hex byte swapping and obfuscated Base64 encoding. The new suite builds on this approach with improved encoding schemes and operational security. Telegram's legitimate traffic patterns make network-level detection challenging. **AI-Assisted Development Indicators**: Code analysis reveals patterns consistent with AI-assisted development: uniform code commenting styles, consistent error handling patterns across all four components, and code generation artifacts suggesting automated mutation or generation. This represents a concerning trend in APT tooling — AI acceleration of malware development cycles. **Infrastructure Overlap with MuddyWater**: Network infrastructure analysis shows overlap with historically attributed MuddyWater C2 servers, including shared IP ranges, hosting providers, and domain registration patterns. MuddyWater (also known as Mango Sandstorm, MERCURY, Static Kitten, Seedworm, Earth Vetala, TEMP.Zagros) is a subordinate element of Iran's Ministry of Intelligence and Security (MOIS), active since approximately 2017, conducting cyber espionage targeting government, telecommunications, defense, oil and gas sectors across Asia, Africa, Europe, and North America. **Kill Chain**: Initial access via spearphishing attachments (malicious Office documents with VBA macros or PDF files with embedded links) delivers GhostFetch or HTTP_VIP downloaders. These retrieve and execute the CHAR Rust backdoor, which establishes persistent C2 via Telegram Bot API. GhostBackDoor is deployed as a redundancy measure. Post-compromise activities include credential harvesting (LaZagne, Mimikatz patterns), lateral movement via stolen credentials, and data exfiltration over the C2 channel. **Relationship to TL-2026-0158**: This represents a continuation of MuddyWater operations documented in TL-2026-0158 (Operation Olalampo), but with significantly modernized tooling. The shift from PowerShell/Python to Rust for the primary implant, combined with AI-assisted development, indicates an ongoing investment in capability enhancement by Iran's MOIS cyber operations unit.