Operation Olalampo MuddyWater Deploys AI-Assisted Rust Malware Across MENA

On January 26, 2026, MuddyWater - an Iranian state-aligned APT group linked to Iran's Ministry of Intelligence and Security (MOIS) - launched Operation Olalampo, a structured espionage campaign targeting government and enterprise organizations across the Middle East and North Africa. The group, tracked as Earth Vetala by Trend Micro, Mango Sandstorm by Microsoft, and MUDDYCOAST by NATO, deployed a new arsenal of malware families purpose-built for this campaign. Group-IB published a detailed technical analysis in February 2026, documenting the operation's scope and capabilities.

Initial access followed two parallel vectors: spear-phishing emails with malicious Office macros, and exploitation of recently disclosed vulnerabilities on public-facing servers. This dual-vector approach ensures that organizations with strong email filtering can still be reached through unpatched internet-exposed infrastructure.

The campaign introduced four new malware families and incorporated AI-assisted development techniques - both firsts for MuddyWater.

GhostFetch: A downloader that establishes initial foothold and retrieves secondary payloads. Drops GhostBackDoor - an advanced implant providing persistent access, keylogging, screen capture, and data exfiltration capabilities.

CHAR: A Rust-based backdoor - MuddyWater's first known use of Rust for malware development. Rust provides memory safety guarantees that make the malware more stable and harder to reverse-engineer. The choice of Rust indicates a deliberate investment in tooling sophistication.

HTTP_VIP: An alternative downloader using HTTP-based communication, providing redundancy if Telegram-based channels are disrupted.

Telegram C2: Using Telegram's API for command-and-control makes traffic harder to distinguish from legitimate messaging activity. Multiple Telegram channels provide redundant C2 paths.

MuddyWater is using AI to accelerate code generation, obfuscation, and potentially to adapt malware behavior based on target environment. This represents a qualitative shift in the group's capability and aligns with the broader trend of state-sponsored groups incorporating AI into offensive operations, as documented by the UAE Cybersecurity Council's February 2026 report on AI-powered attack tools.