Classification: TLP:CLEAR
Analyst: AI Threat Intelligence

Executive Summary

CloudSEK's public disclosure and multiple sandbox analyses corroborate a targeted spear-phishing campaign delivering a Rust-compiled remote access implant (RustyWater) via a malicious Word document (Cybersecurity.doc) containing an embedded VBA macro that writes and executes a dropped installer (CertificationKit.ini) which in turn launches a Rust PE (reddit.exe). The implant exhibits process injection, registry Run-key persistence, anti-analysis measures, and an HTTP-based JSON C2 employing Base64 and lightweight XOR obfuscation. These technical findings and core IOCs are supported at High confidence by vendor reporting and sandbox evidence.

Attribution to the threat actor MuddyWater is assessed at Medium confidence: CloudSEK links macro code reuse (unique function names) and targeting patterns consistent with MuddyWater, but closed-source EDR/telemetry and historical registrant/ownership proof were not available in the reviewed artifacts to elevate confidence to High.

Investigation Objective & Methodology

Original Question: Please do a Deep Dive analysis for this news: "MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors" (from Investigation Objective)

Scope: Open-source confirmation and technical analysis of the reported campaign; extraction and enrichment of IOCs (domains, IPs, URLs, hashes, email addresses); infrastructure enrichment (DNS/WHOIS/hosting where available); technical analysis of RustyWater capabilities; correlation with known MuddyWater TTPs for attribution assessment.

Timeframe: Last 30 days (approx. 2025-12-12 to 2026-01-11)

Sources Used: Vendor write-up (CloudSEK), public sandbox analyses (ANY.RUN, JoeSandbox), MalwareBazaar sample listings, VirusTotal metadata and the artifacts provided for this investigation (research_findings.md, enriched_iocs.md, infrastructure_analysis.md, malware_actor_correlation.md, intelligence_analysis.md, fact_check.md).

Methodology: Triangulate vendor disclosure with public sandbox behavior and sample repositories; validate IOCs present in CloudSEK appendix against sandbox PCAPs and MalwareBazaar entries; assess technical behaviors from static and dynamic analyses documented in sandboxes; evaluate attribution claims against code-level fingerprints and infrastructure patterns; note limitations where closed-source telemetry or WHOIS/passive-DNS yields were absent.

Key Findings (Evidence-based)

High Confidence Findings

• Delivery: The campaign used a malicious Word document named Cybersecurity.doc with embedded VBA macro that decodes a hex blob and writes/executes a dropped installer (CertificationKit.ini). Evidence: CloudSEK disclosure and sandbox runs. (Confidence: HIGH) — supporting artifact: RustyWater (reddit.exe) and associated samples documented in the references below.
• Malware capabilities: The Rust PE (reddit.exe) implements asynchronous networking using Rust crates (reqwest/tokio), performs process injection (targeting explorer.exe), sets persistence via a Registry Run key pointing to CertificationKit.ini, and contains anti-analysis (VEH handler) behaviors; C2 protocol is HTTP JSON with Base64 and a lightweight XOR obfuscation layer. (Confidence: HIGH) — see nomercys[.]it[.]com and sample hashes below.
• IOCs / Infrastructure: Sandbox PCAPs and MalwareBazaar link the implant to domain nomercys[.]it[.]com resolving to IP 159[.]198[.]66[.]153. A characteristic GET for /favicon.ico from the dropped binary is documented in sandbox captures. (Confidence: HIGH)

Medium Confidence Findings

• Attribution: CloudSEK attributes the campaign to the MuddyWater intrusion set based on VBA macro code reuse (function names such as WriteHexToFile / love_me) and targeting overlap; this attribution is plausible but lacks closed-source telemetry in the reviewed artifacts to reach High. (Confidence: MEDIUM) — see MuddyWater and analysis in the Evidence section.
• Supporting infrastructure: Additional campaign domains (Cloudflare-fronted) include stratioai[.]org and bootcamptg[.]org; associated IP pivots include sample hashes and IPs (see IOC Annex). (Confidence: MEDIUM-HIGH)

Detailed Technical Analysis

Delivery

• Vector: Spear-phishing email with attachment. Lure subject reported as "Cybersecurity Guidelines" and sender impersonation observed for info[@]tmcell. The attached Word document Cybersecurity.doc contains an embedded VBA macro that stores a long hex blob within a UserForm (UserForm1.TextBox1) and decodes it to write CertificationKit.ini to C:\ProgramData, then executes it. Evidence: CloudSEK writeup and sandbox runs. (Confidence: HIGH) — see email artifact MuddyWater (for attribution context) and mail sender info[@]tmcell.

Malware Capabilities

• Loader chain: VBA macro -> CertificationKit.ini (dropped installer) -> reddit.exe (Rust PE). (Confidence: HIGH) f38a56b8dc0e8a5... (doc hash) and 7523e53c979692f9eecf... (reddit.exe hash).
• Execution & Evasion: Binary contains VEH-based anti-debug handlers and anti-EDR scanning heuristics observed in sandboxes. (Confidence: HIGH) RustyWater (reddit.exe).
• Privilege / Lateral: The implant performs process injection using VirtualAllocEx/WriteProcessMemory into explorer.exe, enabling code execution in a trusted process. (Confidence: HIGH) RustyWater (reddit.exe).
• Persistence: Registry Run key pointing to C:\ProgramData\CertificationKit.ini observed in sandbox artifacts; primary persistence mechanism is the Run key. (Confidence: HIGH) — see CertificationKit[.]ini.

Command & Control (C2)

• Protocol: HTTP-based JSON payloads. Payload fields include Base64-encoded content which is XOR-obfuscated at the byte level. The implant performs an initial GET of /favicon.ico followed by JSON exchanges over HTTP to the C2 host. (Confidence: HIGH) — observed in ANY.RUN and JoeSandbox PCAPs targeting nomercys[.]it[.]com -> 159[.]198[.]66[.]153).

MITRE ATT&CK Mapping (Observed)

Attribution Assessment

• Attribution claim: MuddyWater is the likely actor behind this campaign per CloudSEK. (Working hypothesis: MuddyWater)
• Confidence: MEDIUM.
• Rationale:
  • Supporting evidence: Code-level fingerprints in VBA macros (function names such as WriteHexToFile and love_me) and targeting of Middle East diplomatic/maritime/telecom sectors mirror historically observed MuddyWater tradecraft; CloudSEK documents these linkages. (Source: malware_actor_correlation.md; research_findings.md)
  • Limitations: No closed-source EDR telemetry, historical owner registrant proofs, or vendor-provided long-term telemetry were present in the reviewed artifacts to definitively tie infrastructure and code to MuddyWater. Opportunistic hosting (Namecheap, Cloudflare fronting) is common across many actors and therefore not uniquely identifying. (See Fact Check & Gaps.)
• Assessment: Treat attribution to MuddyWater as a plausible working hypothesis (MEDIUM). Use it to prioritize hunting in relevant sectors and geographies, but avoid public attribution statements requiring High confidence until closed-source telemetry or definitive infrastructure ownership links are obtained.

Recommendations & Mitigation

Immediate Actions (Priority 1) 🚨

Short-term Actions (Priority 2) ⚠️

Long-term Improvements (Priority 3) 🎯

• Create YARA rules for the VBA macro pattern (embedded long hex blob + WriteHexToFile / love_me) and for Rust binary static markers (reqwest/tokio strings, XOR-base64 framing). (Actionable for proactive detection across mail and endpoint stores.)
• Implement enhanced mail attachment detonation workflows for high-risk attachments and automated extraction of macro function names/signatures for rapid triage.
• Re-run WHOIS/passive DNS and certificate transparency (crt.sh) lookups periodically to capture historical pivots and registrant changes.

Detection Opportunities 🔍

• Proxy/NGFW signatures: Detect and flag HTTP GET to hXXps://nomercys[.]it[.]com/favicon[.]ico and subsequent JSON POSTs with Base64 fields. Capture headers and user-agent strings for further pivoting. (HIGH confidence)
• EDR behavioral detections: Monitor for VirtualAllocEx/WriteProcessMemory/CreateRemoteThread sequences originating from reddit[.]exe or processes spawned from C:\ProgramData\CertificationKit[.]ini. (HIGH confidence)
• Mail gateway rules: Heuristics for embedded long hex blobs in VBA UserForm controls and macro function names WriteHexToFile / love_me. (HIGH confidence for pattern; MEDIUM for sender-based detection)
• YARA examples (starting points): match strings for "reqwest" / "tokio" in PE string table and VBA function names; match embedded long hex decode routine structure in macro text. (Use sandbox artifacts to refine rules.)

IOC Annex (defanged)

Note: Additional SHA256s from CloudSEK appendix are available in the source artifacts and enrichment CSV and are categorized MEDIUM/CRITICAL in enrichment; incorporate those into blocking/hunting as appropriate. (See Evidence & Sources.)

Confidence & Limitations

High Confidence:

• Delivery chain (malicious Word doc -> VBA macro -> CertificationKit[.]ini -> reddit[.]exe) and the core malware behaviors (process injection, registry Run-key persistence, HTTP JSON C2 with Base64 + XOR, use of Rust crates) are strongly supported by CloudSEK and multiple sandbox analyses. (Cited in research_findings.md, enriched_iocs.md, malware_actor_correlation.md)

Medium Confidence:

• Attribution to MuddyWater based on macro code reuse and targeting is plausible but lacks closed-source telemetry and registrant/ownership proofs in the reviewed artifacts. Use as a working hypothesis. (Cited in malware_actor_correlation.md and intelligence_analysis.md)

Limitations / Gaps:

• Closed-source telemetry (enterprise EDR logs, historical vendor YARA hits, long-term infrastructure ownership) was not available in the provided artifacts—this prevents elevating attribution confidence to High. (Fact check and analysis artifacts document these gaps.)
• WHOIS/passive-DNS/CRT.sh/ASN queries were not fully retrieved during enrichment due to collection limitations; re-running these queries is recommended. (See infrastructure_analysis.md and fact_check.md)

Evidence & Sources

Primary artifacts used in this report (selected):

• Vendor write-up: CloudSEK — "Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant" (primary disclosure and IOC appendix). See research_findings.md and intelligence_analysis.md for summary.
• Sandbox & sample repositories: MalwareBazaar entries and ANY.RUN / JoeSandbox analyses for Cybersecurity.doc and reddit.exe (see enriched_iocs.md and research_findings.md).
• IOC Enrichment: enriched_iocs.md (hash reputations, hosting, VT links)
• Threat context & attribution discussion: malware_actor_correlation.md
• Validation & confidence weighting: reviews/fact_check.md and reviews/intelligence_analysis.md


‍

Prepared by: AI Threat Intelligence

‍