MuddyWater APT Weaponizing Word Documents to Deliver ‘RustyWater’ Toolkit Evading AV and EDR Tools

Cybersecuritynews •Tushar Subhra Dutta • January 9, 2026

The Iran-linked MuddyWater Advanced Persistent Threat group has launched a sophisticated spear-phishing campaign targeting diplomatic, maritime, financial, and telecom sectors across the Middle East. The threat actors are using weaponized Word documents to deliver a new Rust-based malware called RustyWater, which represents a major change from their traditional PowerShell and VBS tooling. This upgraded implant […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MuddyWater APT Uses RustyWater Malware in Spear-Phishing Campaign The Iran-linked MuddyWater APT group has initiated a spear-phishing campaign targeting various sectors including diplomatic, maritime, financial, and telecom across the Middle East. They are utilizing weaponized Word documents to deploy a new Rust-based malware known as RustyWater, marking a shift from their previous PowerShell and VBS tools. 2 sources 35

Extracted Entities

MuddyWater APT Weaponizing Word Documents to Deliver ‘RustyWater’ Toolkit Evading AV and EDR Tools

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Industries (1)

Malware (1)

MITRE ATT&CK (1)

Tools (1)