Group-IB published its analysis of Operation Olalampo this week, tracking a MuddyWater campaign that has been running since January 26, 2026. The headline finding is four previously undocumented malware families — including a Rust-written backdoor using Telegram as its command-and-control channel. The presence of emojis in debug strings throughout the codebase is being assessed as a marker of AI-assisted development, consistent with a pattern that has now appeared across multiple Iranian state-linked groups.
The group
MuddyWater is attributed to Iran’s Ministry of Intelligence and Security (MOIS) with high confidence across multiple intelligence vendors. Active since at least 2017, the group’s operational focus has consistently been government ministries, national infrastructure operators, and telecoms carriers across the Middle East and Central Asia. Unlike IRGC-linked groups that blend espionage with destructive operations, MuddyWater is primarily an intelligence-collection actor, pursuing long-dwell access to sensitive government networks.
Operation Olalampo is a continuation of that mandate, not a departure from it.
Four new tools
CHAR is the most technically significant addition. Written in Rust — a language choice that makes signature-based detection harder and complicates reverse engineering — it operates as a persistent backdoor with a Telegram bot as its C2 channel. Group-IB observed communications routed through a bot designated “stager_51_bot” in the sample telemetry. Capabilities include command execution, file system access, and credential harvesting. The use of Telegram for C2 is not novel in the threat landscape, but it is a shift for MuddyWater, which has historically favoured direct C2 over legitimate-service relay.
GhostFetch is a lightweight downloader. Its role is staging: it retrieves and executes secondary payloads after initial access is established. It is likely the component responsible for pulling CHAR into environments after a foothold is secured.
HTTP_VIP deploys AnyDesk, the legitimate remote desktop tool. Abusing commercial remote access software is a standard technique for maintaining access while blending into normal enterprise traffic — AnyDesk connections are unlikely to trigger alerting in environments where it is otherwise used.
GhostBackDoor provides an interactive shell. The name is unremarkable; the capability is not. An interactive shell on a target government or energy network is the access that enables lateral movement, data staging, and the kind of quiet, sustained collection that is MuddyWater’s signature operational output.
AI-assisted development
Group-IB assessed that the malware families show evidence of LLM-assisted coding. The primary indicator is emojis embedded in debug output strings — a pattern that appears in AI-generated code and is unlikely to be introduced by experienced malware developers working manually. This is now the third Iranian-linked group in 2026 where AI-assisted development has been inferred from malware artefacts, following similar assessments of IRGC-linked tooling earlier in the year.
Initial access and infrastructure
Entry is via spear-phishing emails with malicious Office macro attachments, the long-standing MuddyWater delivery method. Group-IB also documented exploitation of vulnerabilities in public-facing servers as a second initial access vector — consistent with broader MuddyWater behaviour observed in 2025 when the group began pairing phishing campaigns with opportunistic perimeter exploitation.
C2 infrastructure includes promoverse[.]org and codefusiontech[.]org, both of which Group-IB links to MuddyWater activity dating to October 2025. Reuse of infrastructure across campaigns at this interval suggests either that the group believes these domains remain undetected, or that the operational tempo does not permit cycling faster.
Who is being hit
Targets confirmed by Group-IB span government ministries, energy sector operators, and telecommunications carriers across the MENA region. No specific country attributions are published in the public report, which is consistent with how Group-IB handles politically sensitive regional targeting.
The sector list is a direct match for MuddyWater’s historical targeting profile. Government networks carry diplomatic and intelligence value; energy and telecoms provide infrastructure visibility that has independent strategic worth — knowledge of grid topology or carrier routing is useful beyond the records it produces.
Defensive indicators
- Block or monitor outbound Telegram Bot API traffic (api.telegram.org) from endpoints and servers that have no business reason to communicate with it
- Add promoverse[.]org and codefusiontech[.]org to DNS blocklists
- Review macro execution policy across Office deployments — blocked-by-default with exceptions for signed documents is the baseline
- Hunt for AnyDesk installations on systems where it has not been explicitly authorised; HTTP_VIP’s deployment mechanism should leave installation artefacts
- Prioritise patching on internet-facing servers given the documented dual-vector initial access approach