MuddyWater Uses Russian MaaS in New ChainShell Attack

JUMPSEC reports that Iran-linked espionage group MuddyWater has been using a Russian malware-as-a-service (TAG-150 / CastleRAT) ecosystem alongside a newly documented JavaScript/Node.js agent called “ChainShell” (which resolves C2 via an Ethereum smart contract) to target Israeli organizations; analysis includes samples, timestamps, certificate/JWT-based attribution, behavioral details, and IoCs (domains, IPs, and staging hosts) for defenders to investigate.