MuddyWater launched a spear-phishing campaign aimed at diplomatic, maritime, financial, and telecom organizations across the Middle East. The attackers relied on weaponized Word documents with embedded macros to deploy RustyWater, a Rust-based implant. Once installed, the malware persists through a Run registry key, communicates with command-and-control over HTTP, and injects code into explorer.exe to blend into normal user activity. The implant incorporates anti-analysis safeguards and supports modular post-compromise functionality to extend attacker control.
CloudSEK’s TRIAD team analyzed the malicious document, recovered the hex-encoded payload, and identified the Rust executable .exe. Static inspection showed the use of the reqwest library for HTTP-based C2, a Vectored Exception Handler mechanism for anti-debugging, and persistence via the CurrentUser Run registry path. Dynamic testing confirmed process injection into explorer.exe and asynchronous C2 behavior with randomized callback timing. The investigation compiled key indicators, including hashes, registry artifacts, and the malicious domains used for communications.
Watch for suspicious modifications to HKCU\Software\Microsoft\Windows\CurrentVersion\Run, especially entries that point to binaries stored under ProgramData. Detect macro-driven execution chains where Office spawns cmd.exe via WScript.Shell. Add network detections for HTTP traffic patterns consistent with JSON → Base64 → XOR encoding and for beaconing with randomized jitter. Strengthen email controls to block or quarantine macro-enabled Word attachments from unknown or untrusted senders.
If RustyWater activity is detected, isolate the endpoint and acquire a memory image to support injection-focused forensics. Remove the malicious Run-key persistence and delete any dropped files in ProgramData. Block the identified C2 domains and IPs at perimeter controls. Expand hunting to identify related macro activity and explorer.exe injection artifacts across the environment to ensure complete containment.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An APT operator receives a spear‑phishing email with a malicious macro‑enabled Office attachment. Upon opening, the macro drops two payload files— Cybersecurity.doc and CertificationKit.ini —into the ProgramData directory to hide them in a location trusted by many applications. The macro uses PowerShell to write the files, which triggers Sysmon file‑create events that the detection rule monitors.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
