# CHAR Rust Backdoor + GhostFetch/GhostBackDoor/HTTP_VIP — Iran MOIS-Linked MuddyWater AI-Assisted Malware Suite with Telegram Bot C2

> The UK NCSC weekly threat report (March 1, 2026) identifies a new MuddyWater malware suite comprising CHAR (Rust-based backdoor), GhostFetch and HTTP_VIP (downloaders), and GhostBackDoor (advanced backdoor). Infrastructure analysis reveals overlap with historic MuddyWater (Iran/MOIS-linked) operations, featuring AI-assisted code generation, heavy obfuscation, and Telegram Bot API for C2 — evolving from the Small Sieve Python backdoor documented in CISA/FBI/CNMF/NCSC-UK joint advisory AA22-055A.

- **Published:** 2026-03-01T06:53:13Z
- **Last reviewed:** 2026-03-01T06:53:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0160
- **ID:** TL-2026-0160
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CHAR represents a significant evolution in MuddyWater's malware arsenal — a Rust-based backdoor marking the group's first known use of the Rust programming language for implant development. This language choice provides memory safety guarantees that complicate reverse engineering and exploitation of the implant itself, while also generating binaries that are harder for traditional signature-based detection to fingerprint due to Rust's unique compilation artifacts and standard library linking patterns.
The campaign deploys a four-component malware suite:
1. **CHAR (Rust Backdoor)**: The primary implant, compiled in Rust with heavy string obfuscation and anti-analysis techniques. CHAR provides full remote access capabilities including command execution, file operations, process manipulation, and credential harvesting. The Rust implementation suggests deliberate investment in tooling modernization — MuddyWater historically relied on PowerShell (POWERSTATS), Python (Small Sieve, Out1), and .NET payloads.
2. **GhostFetch (Downloader)**: A lightweight first-stage downloader responsible for initial beacon and payload retrieval. GhostFetch establishes initial C2 contact and downloads the CHAR implant or other second-stage payloads. Uses HTTP/HTTPS with custom User-Agent strings and encoded beacon parameters.
3. **HTTP_VIP (Downloader)**: An alternative first-stage downloader with HTTP-based C2, featuring anti-sandbox checks (timing-based execution delays, environment fingerprinting) before payload delivery. HTTP_VIP checks for virtualization indicators, debugger presence, and sandbox artifacts before proceeding with download operations.
4. **GhostBackDoor (Advanced Backdoor)**: A secondary backdoor providing redundant access with additional capabilities including screenshot capture, keylogging, and browser credential theft. GhostBackDoor serves as a persistence mechanism if the primary CHAR implant is detected and removed.
**Telegram Bot C2 Channel**: The campaign uses Telegram Bot API as a C2 channel — a direct evolution from MuddyWater's Small Sieve backdoor (documented in NCSC-UK MAR and CISA AA22-055A). Small Sieve used Telegram Bot API over HTTPS with hex byte swapping and obfuscated Base64 encoding. The new suite builds on this approach with improved encoding schemes and operational security. Telegram's legitimate traffic patterns make network-level detection challenging.
**AI-Assisted Development Indicators**: Code analysis reveals patterns consistent with AI-assisted development: uniform code commenting styles, consistent error handling patterns across all four components, and code generation artifacts suggesting automated mutation or generation. This represents a concerning trend in APT tooling — AI acceleration of malware development cycles.
**Infrastructure Overlap with MuddyWater**: Network infrastructure analysis shows overlap with historically attributed MuddyWater C2 servers, including shared IP ranges, hosting providers, and domain registration patterns. MuddyWater (also known as Mango Sandstorm, MERCURY, Static Kitten, Seedworm, Earth Vetala, TEMP.Zagros) is a subordinate element of Iran's Ministry of Intelligence and Security (MOIS), active since approximately 2017, conducting cyber espionage targeting government, telecommunications, defense, oil and gas sectors across Asia, Africa, Europe, and North America.
**Kill Chain**: Initial access via spearphishing attachments (malicious Office documents with VBA macros or PDF files with embedded links) delivers GhostFetch or HTTP_VIP downloaders. These retrieve and execute the CHAR Rust backdoor, which establishes persistent C2 via Telegram Bot API. GhostBackDoor is deployed as a redundancy measure. Post-compromise activities include credential harvesting (LaZagne, Mimikatz patterns), lateral movement via stolen credentials, and data exfiltration over the C2 channel.
**Relationship to TL-2026-0158**: This represents a continuation of MuddyWater operations documented in TL-2026-0158 (Operation Olalampo), but with significantly modernized tooling. The shift from PowerShell/Python to Rust for the primary implant, combined with AI-assisted development, indicates an ongoing investment in capability enhancement by Iran's MOIS cyber operations unit.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583.006 Web Services
- T1588.002 Tool
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1047 Windows Management Instrumentation
- T1559.001 Component Object Model
- T1203 Exploitation for Client Execution
- T1053.005 Scheduled Task
- T1547.001 Registry Run Keys / Startup Folder
- T1137.001 Office Template Macros
- T1548.002 Bypass User Account Control
- T1027 Obfuscated Files or Information
- T1027.010 Command Obfuscation
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1218.003 CMSTP
- T1218.005 Mshta
- T1480 Execution Guardrails
- T1574.001 DLL
- T1685 Disable or Modify Tools
- T1003.001 LSASS Memory
- T1003.004 LSA Secrets
- T1555.003 Credentials from Web Browsers
- T1087.002 Domain Account
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1056.001 Keylogging
- T1113 Screen Capture
- T1071.001 Web Protocols

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0160