The Iranian state-sponsored group MuddyWater (also known as Mango Sandstorm) is currently conducting Operation Olalampo, a sophisticated cyber-espionage campaign targeting government and private sector organizations across the Middle East and North Africa.

According to research from Group-IB, the group has updated its toolkit with several new malware families designed to bypass traditional defenses:

• GhostFetch: A custom downloader used to fetch and execute secondary payloads.
• CHAR: A backdoor written in Rust, a choice that helps the malware evade signature-based detection.
• GhostBackDoor: A persistent implant that allows attackers to maintain long-term access to compromised networks.

The campaign typically begins with spear-phishing emails carrying malicious attachments. Once a system is infected, MuddyWater uses Telegram bots for command-and-control (C2) communication, streamlining their ability to exfiltrate sensitive data. This shift toward custom-coded tools like CHAR and GhostFetch signals a move away from their previous reliance on legitimate remote monitoring and management (RMM) software.