Threat reportAPTTL-2026-4940
MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns Targeting the Middle East and Global Organizations
MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns (TL-2026-4940), also tracked as RustyWater, is a high-severity advanced persistent threat campaign, first published 2026-11-01. It is attributed to MuddyWater (Iran) with high confidence, affects Microsoft Office / Word (VBA macros and remote template loading), maps to 17 MITRE ATT&CK techniques (T1027.013, T1033, T1036), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 1MuddyWater
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4940
- Threat ID
- TL-2026-4940
- Also known as
- RustyWater, Archer RAT, RUSTRIC
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- MuddyWater
- Attribution confidence
- HIGH
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, government administration, diplomatic, education, insurance, it-services, finance, maritime, hosting
- Target regions
- Middle East, israel, iraq, jordan, egypt, oman, turkmenistan, malaysia, Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns
Malware and tooling: Archer RAT, Remote Utilities, Atera, ScreenConnect, SimpleHelp, Syncro
How MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns works
Genians chronology of MuddyWater APT activity (2019-2026), assessed as affiliated with Iran's Ministry of Intelligence and Security (MOIS). The group uses spear-phishing with malicious Word documents (VBA macros, external template loading), PowerShell and Rust-based payloads, and legitimate RMM tools for long-term access and intelligence collection against telecom, academic, insurance, IT-services and diplomatic targets.
MuddyWater was first named by Palo Alto Networks Unit 42 in November 2017 and is assessed by Genians as affiliated with Iran's Ministry of Intelligence and Security (MOIS). CISA, FBI, CNMF and NCSC-UK jointly described it in advisory AA22-055A (24 February 2022) as a subordinate element within MOIS. The Genians chronology documents a consistent focus on long-term infiltration and intelligence collection across the Middle East, with expansion to global diplomatic and UN-affiliated targets.
Early cases (2019) used spear-phishing Word documents with VBA macros that launched PowerShell backdoors. In March 2019 an Iraqi mobile network operator was targeted with a macro document using blurred-image social engineering. In April 2019 a Jordanian university member received a document impersonating the Civil Status and Passport Department (cspd.gov.jo) that loaded a remote template via an OpenXML attachedTemplate relationship, and the VBA then invoked PowerShell.
From late 2022 the group shifted to legitimate remote monitoring and management (RMM) tools. Egyptian IT/hosting (October 2022), three Israeli insurers (November 2022) and a Malaysian pension fund official (April 2023) received HTML attachments or Dropbox/OneDrive links delivering ZIP archives containing a Syncro MSI installer. In April 2024, 27 Israeli university mailboxes were targeted from a compromised university account with a password-protected RAR (password 123456, given in the email body) containing an Atera installer (digitalform.msi). Genians also documents abuse of Remote Utilities, ScreenConnect, SimpleHelp, N-Able, Splashtop, AnyDesk and TeamViewer.
In 2025-2026 the group delivered custom payloads from macro documents. On 19 August 2025 hundreds of recipients, including foreign ministries, embassies and UN-affiliated organisations, received an 'official invitation' impersonating Oman's Ministry of Foreign Affairs (lure: Iran-Israel war seminar; Online Seminar.FM.gov.om.doc). Document_Open() decoded a payload into C:\Users\Public\Documents\ManagerProc.log; the implant collects username, computer name and privilege level and beacons to screenai[.]online. On 17 November 2025 a Hebrew-language email ('New company guidelines and regulations') carrying Webinar.doc targeted an Israeli IT/security/remote-support provider. The macro (love_me_) dropped PhotoAcq.log to the Downloads folder and launched it via WMI Win32_Process. The payload is a Rust binary with a SentinelOne icon (PDB path ...\phonix\phoenix\x64\Release\phoenix.pdb). It enumerates 28 security vendors, runs whoami.exe, hostname.exe and nslookup.exe, and talks HTTPS (SSPI TLS) to stratioai[.]org (159.198.68.25). On 5 January 2026 'New Cybersecurity Guidelines' emails impersonating a Turkmenistan state-owned mobile operator carried Cybersecurity.doc, which dropped C:\ProgramData\CertificationKit.ini (a Rust x64 EXE with a Cloudflare icon, original name reddit.exe) and executed it with cmd.exe /c; C2 is nomercys.it[.]com (159.198.66.153). This activity corresponds to the RustyWater/Archer RAT implant reported by CloudSEK in January 2026.
Related 2026 reporting by Group-IB (Operation Olalampo, first observed 26 January 2026) attributes GhostFetch, GhostBackDoor, HTTP_VIP and the Rust backdoor CHAR (Telegram-bot controlled) to MuddyWater with high confidence. This is context only; those samples are not part of the Genians IOC set.
Detection should focus on Office-spawned process chains (WINWORD -> WMI/cmd -> file with .log/.ini extension executing as PE), remote template fetches by Office, unsanctioned RMM installer execution, and egress to the listed infrastructure. Note: Genians lists 51 MD5 hashes; the 39 retrievable were reviewed and 10 representative values are recorded here.
MITRE ATT&CK techniques used in TL-2026-4940
Defense Evasion
T1027.013 Encrypted/Encoded File; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1221 Template Injection
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
Persistence
T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Affected products and versions in MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns
- Microsoft — Office / Word (VBA macros and remote template loading)
Vulnerable versions: Configurations allowing macros and remote templates - Various — Legitimate RMM tools abused (Syncro, Atera, Remote Utilities, ScreenConnect, SimpleHelp, N-Able)
Vulnerable versions: Abused as designed; no vulnerability involved
Remediation for MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns
Immediate actions
- Block screenai.online, stratioai.org, nomercys.it.com, 159.198.68.25 and 159.198.66.153 at DNS, proxy and firewall
- Hunt endpoints for ManagerProc.log, PhotoAcq.log and CertificationKit.ini and for the published MD5 hashes
- Audit for unsanctioned RMM agent installs (Syncro, Atera, ScreenConnect, SimpleHelp, N-Able, Remote Utilities, Splashtop, AnyDesk, TeamViewer)
- Alert on Office applications spawning WMI, cmd.exe or PowerShell, and on executables written with .log or .ini extensions
Workarounds
- Disable 'Enable Content' for documents from external senders
- Restrict access to personal Dropbox/OneDrive shares from corporate endpoints
Longer-term hardening
- Block VBA macros from internet-origin documents via Group Policy / Intune
- Block Office remote template loading and restrict encrypted archive attachments at the mail gateway
- Allow-list RMM tooling and alert on any other RMM installer or signed MSI from email or cloud storage
- Deploy EDR with behavioural detection of macro-to-executable chains and security-product enumeration
- Train staff on diplomatic, university and 'cybersecurity guideline' lures
Timeline of MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns
- Palo Alto Networks Unit 42 publishes 'Muddying the Water' and names the MuddyWater group (Feb-Oct 2017 activity).
- Spear-phishing Word macro targets an Iraqi mobile network operator, deploying a PowerShell-based backdoor.
- Jordanian university member targeted with a document impersonating cspd.gov.jo that loads a remote template via OpenXML attachedTemplate and runs VBA-launched PowerShell.
- CISA, FBI, CNMF and NCSC-UK publish AA22-055A identifying MuddyWater as a subordinate element within MOIS.
- October 2022: Egyptian hosting/IT provider targeted with RMM-based delivery (Syncro); Israeli insurers (Nov 2022) and a Malaysian pension fund official (Apr 2023) follow via HTML/Dropbox/OneDrive lures.
- April 2024: 27 Israeli university accounts targeted from a compromised university mailbox with a password-protected RAR containing the Atera installer digitalform.msi.
- Mass 'official invitation' campaign impersonating Oman's Ministry of Foreign Affairs hits foreign ministries, embassies and UN-affiliated bodies; macro drops ManagerProc.log, C2 screenai.online.
- Hebrew lure with Webinar.doc targets an Israeli IT/security provider; macro drops Rust payload PhotoAcq.log, C2 stratioai.org (159.198.68.25).
- 'New Cybersecurity Guidelines' lure impersonating a Turkmenistan state mobile operator delivers Cybersecurity.doc and Rust payload CertificationKit.ini; C2 nomercys.it.com (159.198.66.153).
- Genians Security Center publishes its chronology of MuddyWater attacks with IOCs.
Sources cited for MuddyWater APT (MOIS-affiliated) Multi-Year Campaigns
- Chronology of MuddyWater APT Attacks Targeting the Middle East
- MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors
- Operation Olalampo: MuddyWater (Group-IB)
- MuddyWater Targets MENA Organizations (The Hacker News)
- Iranian Government-Sponsored MuddyWater Actors Conducting Malicious Cyber Operations (AA22-055A)
- Muddying the Water: Targeted Attacks in the Middle East (Unit 42)
Detection coverage for TL-2026-4940
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4940 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.