IRAN'S MUDDYWATER TARGETS ORGS WITH FRESH MALWARE AS TENSIONS MOUNT

Summary from the TLDR InfoSec newsletter

Iran's MuddyWater (TA450) launched Operation Olalampo, a spear-phishing campaign delivering multiple novel malware strains — including the Rust-based Char backdoor using Telegram for C2, the GhostFetch/GhostBackDoor loader chain, and the HTTP_VIP downloader — against organizations across the Middle East and Africa. Group-IB identified signs of AI-assisted development in Char's command handlers, including debug strings containing emojis that were likely left unsanitized in LLM-generated code segments. Defenders should leverage the published IoCs, YARA rules, and EDR rules to detect activity, while monitoring for unauthorized AnyDesk deployments and Telegram-based C2 traffic.