--- title: "MuddyWater Targets Orgs With Fresh Malware Amid Rising Tensions" url: https://daily.dev/posts/muddywater-targets-orgs-with-fresh-malware-amid-rising-tensions-pxdprestl source_url: https://www.darkreading.com/threat-intelligence/iran-muddywater-new-malware-tensions-mount type: article source: "Dark Reading" published: 2026-02-23T22:51:35.320Z updated: 2026-02-23T22:52:12.267Z tags: ["cyber", "malware"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MuddyWater Targets Orgs With Fresh Malware Amid Rising Tensions **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary Iranian nation-state threat group MuddyWater has launched Operation Olalampo, a new attack campaign targeting organizations in the Middle East, North Africa, and Africa. The campaign uses spear-phishing emails with malicious Microsoft Office documents to deploy several never-before-seen malware strains: the Char backdoor (Rust-based, using Telegram as C2), GhostFetch downloader with GhostBackDoor, and HTTP_VIP downloader that deploys AnyDesk RMM. Notably, the malware shows signs of AI-assisted development, evidenced by debug strings containing emojis in the code. MuddyWater is also experimenting with exploiting public-facing server vulnerabilities as an alternative entry point, marking a tactical evolution for the group. Group-IB researchers recommend defenders use the published IoCs, YARA rules, and EDR rules to monitor for activity. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/muddywater-targets-orgs-with-fresh-malware-amid-rising-tensions-pxdprestl)