Iran's MuddyWater Targets Orgs With Fresh Malware as Tensions Mount

Group-IB describes Operation Olalampo, an active MuddyWater (Iran-linked) campaign targeting organizations across the Middle East and Africa using spear-phishing and some public-server exploits to deliver several new custom malware families (including a Rust-based Char backdoor using a Telegram bot C2, GhostFetch/GhostBackDoor, and the HTTP_VIP downloader that deploys RMM). The report notes AI-assisted development artifacts, infrastructure reuse, and provides IoCs, YARA and EDR guidance and defensive recommendations.