MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP

Operation Olalampo is an active campaign attributed to the Iranian APT MuddyWater targeting organizations across the MENA region; the actor uses phishing (malicious Office macros) and public-facing vulnerability exploits to deliver downloaders and backdoors (GhostFetch, GhostBackDoor, HTTP_VIP, CHAR), enabling remote control, file transfer, data theft and AnyDesk deployment, with indicators of AI-assisted malware development.