Full Report
MuddyWater APT has launched a new cyber offensive operation, dubbed Operation Olalampo, deploying new malware variants and leveraging Telegram bots for command-and-control. Analysis of the campaign provides a glimpse into the group’s post-exploitation tactics, which largely align with their historical operations.
Analysis Summary
# Threat Actor: MuddyWater
## Attribution & Identity
* **Actor Name:** MuddyWater
* **Aliases:** Static Kitten, Mercury, Seedworm, TEMP.Zagros.
* **Known Associations:** Attributed by various intelligence agencies (including the US Cyber Command) to the Iranian Ministry of Intelligence and Security (MOIS).
## Activity Summary
The report details a new cyber offensive campaign titled **Operation Olalampo**. In this operation, MuddyWater deployed new malware variants and updated their Command-and-Control (C2) mechanisms to leverage Telegram bots. While the tools have evolved, the post-exploitation tactics remain consistent with their historical patterns of espionage and persistent access.
## Tactics, Techniques & Procedures
* **Initial Access:** Spear-phishing emails containing malicious attachments (e.g., `intercom.doc`, `ticket.doc`, `attachment.xls`).
* **Execution:** Use of malicious macros in Office documents to trigger secondary payloads.
* **Command and Control (C2):** Utilization of Telegram Bot API for exfiltration and receiving commands (Abuse of legitimate services).
* **Persistence:** Deployment of remote monitoring and management (RMM) tools and custom backdoors.
* **Evasion:** Renaming malicious files to mimic legitimate system processes or software (e.g., `avp.exe`, `FMAPP.exe`).
* **Post-Exploitation:** Credential harvesting and internal reconnaissance.
**MITRE ATT&CK IDs (Inferred from context):**
* T1566.001 - Phishing: Spearphishing Attachment
* T1204.002 - User Execution: Malicious File
* T1102.002 - Web Service: Bidirectional Communication (Telegram)
* T1036.005 - Masquerading: Match Legitimate Name or Location
* T1219 - Remote Access Software (AnyDesk)
## Targeting
* **Sectors:** Historically targets government, telecommunications, oil and gas, and defense sectors.
* **Geography:** Primarily focused on Middle Eastern countries, though they have been known to target entities in Europe, North America, and Asia.
* **Victims:** Not explicitly named in the provided text, but indicators suggest organizations interacting via support tickets or "intercom" systems.
## Tools & Infrastructure
* **Malware Families:** Custom macro-based droppers, new variants of MuddyWater backdoors.
* **RMM Tools:** AnyDesk (specifically `AnyDesk72.exe`).
* **Infrastructure:**
* **C2:** Telegram Bot API (api.telegram[.]org).
* **Filenames:** `FMAPP.exe`, `avp.exe`, `burn.exe`, `CertificationKit.exe`.
* **Indicators (Defanged):**
* SHA1: `324918c73b985875d5f974da3471f2a0a4874687` (AnyDesk72.exe)
* SHA1: `777040bed9d26f5da97e8977c6efc0586beae064` (intercom.doc)
* SHA1: `e79ccc3f6517c911d6c1df79c94e88896f574e64` (ticket.doc)
* Log path: `%USERPROFILE%\downloads\pic[.]log`
## Implications
MuddyWater continues to refine its toolkit to bypass traditional security perimeters by using legitimate cloud services (Telegram) for C2 communication. The group remains a high-tier persistent threat, focusing on long-term espionage. Their shift toward "Operation Olalampo" shows a commitment to evolving their delivery methods while maintaining a high volume of activity against strategic targets.
## Mitigations
* **Email Security:** Implement robust attachment scanning and disable Office macros via Group Policy (GPO) for all non-essential users.
* **Network Monitoring:** Monitor and restrict traffic to the Telegram Bot API (`api.telegram[.]org`) if it is not a required business function.
* **Application Whitelisting:** Use AppLocker or similar tools to prevent the execution of unauthorized RMM tools like AnyDesk.
* **Threat Hunting:** Scan for the specific SHA1 hashes and file paths (like `pic.log` in user profiles) provided in the indicators of compromise.