Back main.whoisxmlapi.com

A Dns Exploration Of Operation Olalampo

main.whoisxmlapi.com • April 11, 2026

MuddyWater has long been active in state- cyber operations. In its latest campaign, dubbed “Operation Olalampo,” the group targeted organizations and individuals primarily across the MENA region, leveraging geopolitical tensions. The attackers deployed new malware variants and used Telegram bots for command-and-control (C&C).

Group-IB identified 1 seven network IoCs associated with the activity. We analyzed all seven IoCs, comprising four domains and three IP addresses, and confirmed that none were tied to legitimate ownership. Using our homegrown tools to investigate the threat, we uncovered these findings:

Download a sample of the threat research materials now or sales to your intelligence needs for threat detection and response or other cybersecurity use cases.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MuddyWater's Operation Olalampo Targets MENA Region with New Malware MuddyWater, an advanced persistent threat (APT) group, has launched 'Operation Olalampo,' targeting organizations and individuals in the MENA region amid ongoing geopolitical tensions. The operation involves the deployment of new malware variants and the use of Telegram bots for command-and-control (C&C) purposes. Group-IB identified seven indicators of compromise (IoCs), including four domains and three IP addresses, all of which were confirmed to lack legitimate ownership. Investigations revealed extensive historical data for the domains and IPs, indicating potential victim communications. The threat actors' tactics and tools suggest a sophisticated approach to cyber operations. The current status of the campaign remains active, with ongoing analysis and threat detection efforts recommended. A sample of the findings is available for further investigation. 3 sources 77

A Dns Exploration Of Operation Olalampo

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)