Group-IB Threat Intelligence documented in a report published on Group-IB Operation Olalampo — a MuddyWater campaign first observed January 26, 2026, targeting organizations and individuals primarily across the MENA region. The operation deployed four new malware variants: the Rust-based CHAR backdoor (using a Telegram bot as C2), GhostFetch downloader, GhostBackDoor advanced backdoor, and HTTP_VIP downloader (deploying AnyDesk RMM). Post-exploitation visibility was gained through monitoring of the exposed Telegram C2 bot, which also revealed infrastructure reuse dating to late 2025. Indicators suggest AI-assisted malware development.
Three Maldoc Variants: Energy/Marine Lures, Decimal-Encoded Payloads, and Sandbox-Evasive Sleep Loops
All three document variants share core macro logic: Workbook_Open() auto-execution, a sandbox evasion sleep implemented as four nested loops of addition operations (bypassing standard sleep-hook detection), and payload retrieval from a hidden UI element (UserForm1.TextBox1.Text) decoded from decimal encoding. Variant 1 (Excel, energy/marine company lure) drops C:\Users\Public\Downloads\novaservice.exe — the CHAR Rust backdoor. Variant 2 (same energy/marine theme) drops C:\Users\Public\Documents\MicrosoftExcelUser.exe — GhostFetch, which downloads GhostBackDoor. Variant 3 (Word, flight ticket/report lures targeting individuals and system integrators) drops to C:\Users\<user>\Downloads\pic.LOG or C:\Users\Public\Documents\MicrosoftWordUser.exe — HTTP_VIP downloader, deploying AnyDesk RMM.
GhostFetch: Hardware/Behavior Anti-Analysis, Reflective Memory Loading, and Noisy Re-Execution
GhostFetch implements aggressive sandbox detection: terminating if RAM is under 2 GB, fewer than 2 CPU cores, or fewer than 2 previously connected USB devices are present; validating mouse movement and screen resolution; scanning for debuggers, VM artifacts, and AV tools; and using GetTickCount64 to detect analyst stepping. If the argument "static" is passed, it launches explorer.exe shell:RecycleBinFolder. Persistence is established by copying itself to %LOCALAPPDATA%\microsoft\windows\burnutill\burn.exe with a minor binary modification (altering the hash) and registering via the User Shell Folders\Startup registry path. It decodes a hardcoded C2 list (primary: promoverse[.]org) to fetch an AES-encrypted PE payload, which is reflectively loaded into memory. After successful second-stage retrieval, the malware repeatedly re-executes itself — generating noisy system activity that could trigger security alerts; the operational rationale is unclear.
Attribution: Macro Logic, String Decoding, CHAR/BlackBeard Rust Overlap, and C2 Infrastructure Reuse
Group-IB attributes Operation Olalampo to MuddyWater with high confidence based on: macro logic matching multiple recent MuddyWater campaigns (UserForm1.TextBox1.Text decimal decoding, four-nested-loop sleep, .log staging file pattern); GhostFetch and GhostBackDoor string decoding techniques consistent with other MuddyWater-linked malware; CHAR's Rust structure and development environment matching the BlackBeard/Archer RAT Rust backdoor (SHA-1: 326b808f4f933f20e4e8686e9a6e93454c8ed334); a co-hosted reverse SOCKS5 DLL (FMAPP.dll) matching reverse SOCKS5 tooling from prior MuddyWater reports; and infrastructure overlap with previously identified MuddyWater C2 infrastructure at netvigil[.]org.