The Iranian state-aligned threat actor MuddyWater — also tracked under the aliases Earth Vetala, Mango Sandstorm, and MUDDYCOAST — has launched a new campaign, internally designated Operation Olalampo, directed at organizations and individuals across the Middle East and North Africa. Group-IB researchers first detected the activity on January 26, 2026.
Infection Chain
The operational methodology follows established MuddyWater tradecraft patterns. The intrusion sequence begins with spear-phishing emails containing malicious Microsoft Office documents. These attachments embed macro code designed to decode and execute a payload on the victim’s system, ultimately granting the attackers remote control. Several infection variants have been documented:
- Excel lure: Macro execution drops the CHAR Rust-based backdoor directly.
- Downloader variant: A similar phishing document deploys GhostFetch, which then fetches and loads GhostBackDoor in memory.
- Themed lure variant: Flight tickets or business report-themed documents deliver HTTP_VIP, which ultimately installs AnyDesk for hands-on-keyboard remote access.
Malware Components
GhostFetch serves as the first-stage loader. Before executing its secondary payload, it performs environmental validation — checking mouse activity, screen resolution, the presence of debugging tools, VM artifacts, and AV software — before retrieving and running its follow-on stage entirely in memory.
GhostBackDoor, dropped by GhostFetch, provides the operator with an interactive shell, file read/write access, and the ability to re-invoke GhostFetch for persistence or payload rotation.
HTTP_VIP is a native downloader that beacons to a hardcoded C2 at codefusiontech[.]org. Beyond pulling and executing AnyDesk, it supports shell command execution, file transfer in both directions, clipboard capture, and dynamic adjustment of its beacon interval — giving operators considerable post-exploitation flexibility.
CHAR is a Rust-built backdoor controlled through a Telegram bot named “Olalampo” (username: stager_51_bot). It provides directory traversal and cmd.exe/PowerShell execution. Observed PowerShell payloads launched from CHAR include a SOCKS5 reverse proxy, an additional backdoor called Kalim, browser data exfiltration routines, and auxiliary binaries (sh.exe, gshdoc_release_X64_GUI.exe).
AI-Assisted Development
Static analysis of CHAR’s source code surfaced debugging strings containing emojis — an artifact researchers flag as a likely indicator of AI-assisted code generation. This is consistent with prior reporting that MuddyWater has been experimenting with generative AI to accelerate development of file transfer and remote execution capabilities.
Code Overlap with BlackBeard / Archer RAT
CHAR shares structural and environmental handling characteristics with BlackBeard (also tracked as Archer RAT and RUSTRIC), another Rust-based implant previously attributed to MuddyWater by CloudSEK and Seqrite Labs. The overlap points to code reuse or a shared internal development pipeline across the group’s toolset.
Initial Access Beyond Phishing
In addition to document-based lures, MuddyWater has been observed exploiting recently disclosed vulnerabilities in internet-facing servers as an alternative initial access vector — broadening the attack surface beyond purely social engineering methods.
Assessment
Operation Olalampo reflects a threat actor in active capability development: modular multi-stage payloads, diversified C2 infrastructure (Telegram bots alongside traditional HTTP C2s), and early adoption of AI tooling for malware engineering. The structural parallels to prior tooling suggest deliberate code reuse rather than coincidental overlap, pointing to a maturing and increasingly systematic development practice within the group.