Follow
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
MuddyWater launched a spear-phishing campaign aimed at diplomatic, maritime, financial, and telecom organizations across the Middle East. The attackers relied on weaponized Word documents with embedded macros to deploy RustyWater, a Rust-based implant. Once installed, the malware persists through a Run registry key, communicates with command-and-control over HTTP, and injects code into explorer.exe to blend into normal user activity. The implant incorporates anti-analysis safeguards and supports modular post-compromise functionality to extend attacker control.
Investigation
CloudSEK’s TRIAD team analyzed the malicious document, recovered the hex-encoded payload, and identified the Rust executable reddit.exe. Static inspection showed the use of the reqwest library for HTTP-based C2, a Vectored Exception Handler mechanism for anti-debugging, and persistence via the CurrentUser Run registry path. Dynamic testing confirmed process injection into explorer.exe and asynchronous C2 behavior with randomized callback timing. The investigation compiled key indicators, including hashes, registry artifacts, and the malicious domains used for communications.
Mitigation
Watch for suspicious modifications to HKCU\Software\Microsoft\Windows\CurrentVersion\Run, especially entries that point to binaries stored under ProgramData. Detect macro-driven execution chains where Office spawns cmd.exe via WScript.Shell. Add network detections for HTTP traffic patterns consistent with JSON → Base64 → XOR encoding and for beaconing with randomized jitter. Strengthen email controls to block or quarantine macro-enabled Word attachments from unknown or untrusted senders.
Response
If RustyWater activity is detected, isolate the endpoint and acquire a memory image to support injection-focused forensics. Remove the malicious Run-key persistence and delete any dropped files in ProgramData. Block the identified C2 domains and IPs at perimeter controls. Expand hunting to identify related macro activity and explorer.exe injection artifacts across the environment to ensure complete containment.
"graph TB %% Class Definitions classDef action fill:#99ccff classDef technique fill:#ffcc99 classDef file fill:#e6e6e6 classDef process fill:#c2f0c2 classDef registry fill:#ffd9b3 classDef data fill:#d9d9ff %% Nodes action_phishing["<b>Action</b> – <b>T1566.001 Spearphishing Attachment</b><br/>Email with malicious Word document is sent to the victim"] class action_phishing action file_doc["<b>File</b> – <b>Name</b>: Cybersecurity.doc<br/><b>Type</b>: Word document containing a VBA macro"] class file_doc file action_user_execution["<b>Action</b> – <b>T1204.002 Malicious File</b><br/>Victim opens the attached document, triggering execution"] class action_user_execution action technique_vba_macro["<b>Technique</b> – <b>T1059.005 Visual Basic</b><br/>VBA macro runs and performs malicious actions"] class technique_vba_macro technique file_ini["<b>File</b> – <b>Name</b>: CertificationKit.ini<br/><b>Purpose</b>: Script executed via WMI"] class file_ini file technique_native_api["<b>Technique</b> – <b>T1106 Native API</b><br/>Macro creates COM objects to interact with the system"] class technique_native_api technique technique_wmi["<b>Technique</b> – <b>T1047 Windows Management Instrumentation</b><br/>WMI is used to launch the .ini script"] class technique_wmi technique technique_reflective_loading["<b>Technique</b> – <b>T1620 Reflective Code Loading</b><br/>Hexu2011encoded payload is decoded in memory and written to disk"] class technique_reflective_loading technique technique_process_injection["<b>Technique</b> – <b>T1055.002 Portable Executable Injection</b><br/>Shellcode is injected into explorer.exe"] class technique_process_injection technique process_explorer["<b>Process</b> – <b>Name</b>: explorer.exe"] class process_explorer process technique_persistence["<b>Technique</b> – <b>T1547 Boot or Logon Autostart Execution</b><br/>Registry Run key is created for persistence"] class technique_persistence technique registry_run["<b>Registry</b> – <b>Key</b>: HKCU\Software\Microsoft\Windows\CurrentVersion\Run"] class registry_run registry technique_encrypted_channel["<b>Technique</b> – <b>T1573 Encrypted Channel</b><br/>C2 traffic is encrypted"] class technique_encrypted_channel technique technique_symmetric_crypto["<b>Technique</b> – <b>T1573.001 Symmetric Cryptography</b><br/>XOR/Base64 used to hide data"] class technique_symmetric_crypto technique technique_credential_hooking["<b>Technique</b> – <b>T1056.004 Credential API Hooking</b><br/>API hooking captures user credentials"] class technique_credential_hooking technique credentials["<b>Data</b> – <b>Type</b>: Captured credentials"] class credentials data %% Connections action_phishing –>|delivers| file_doc file_doc –>|opened by user| action_user_execution action_user_execution –>|triggers| technique_vba_macro technique_vba_macro –>|creates| file_ini technique_vba_macro –>|uses| technique_native_api technique_native_api –>|calls| technique_wmi technique_wmi –>|executes| file_ini file_ini –>|loads| technique_reflective_loading technique_reflective_loading –>|leads to| technique_process_injection technique_process_injection –>|injects into| process_explorer process_explorer –>|enables| technique_persistence technique_persistence –>|writes| registry_run registry_run –>|supports| technique_encrypted_channel technique_encrypted_channel –>|uses| technique_symmetric_crypto technique_symmetric_crypto –>|protects| technique_credential_hooking technique_credential_hooking –>|captures| credentials "
Attack Flow
Detections
Unusual Extension of Executable Binary (via process_creation)
View
Possible Persistence Points [ASEPs – Software/NTUSER Hive] (via registry_event)
View
Suspicious Process without Arguments (via cmdline)
View
Suspicious MSOffice Child Process (via cmdline)
View
IOCs (HashSha256) to detect: Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant
View
Detection of Muddy Water RustyWater Implant Execution [Windows Process Creation]
View
Detection of Muddy Water APT Spear-Phishing Artifacts [Windows File Event]
View
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
-
Attack Narrative & Commands:
An APT operator receives a spear‑phishing email with a malicious macro‑enabled Office attachment. Upon opening, the macro drops two payload files—Cybersecurity.docandCertificationKit.ini—into theProgramDatadirectory to hide them in a location trusted by many applications. The macro uses PowerShell to write the files, which triggers Sysmon file‑create events that the detection rule monitors. -
Regression Test Script:
# ------------------------------------------------- # MuddyWater APT file drop simulation (Windows) # ------------------------------------------------- $progData = $Env:ProgramData # Define payload contents (dummy data for testing) $docContent = "This is a mock Cybersecurity document used for detection testing." $iniContent = "[Settings]`nKey=Value`n" # Create Cybersecurity.doc $docPath = Join-Path -Path $progData -ChildPath "Cybersecurity.doc" $docContent | Out-File -FilePath $docPath -Encoding UTF8 # Create CertificationKit.ini $iniPath = Join-Path -Path $progData -ChildPath "CertificationKit.ini" $iniContent | Out-File -FilePath $iniPath -Encoding UTF8 Write-Host "MuddyWater simulation files created:" Write-Host "`t$docPath" Write-Host "`t$iniPath" # ------------------------------------------------- -
Cleanup Commands:
# Remove simulation artifacts Remove-Item -Path "$Env:ProgramDataCybersecurity.doc" -ErrorAction SilentlyContinue Remove-Item -Path "$Env:ProgramDataCertificationKit.ini" -ErrorAction SilentlyContinue Write-Host "Simulation files removed."