MuddyWater Deploys “RustyWater” RAT via Spear-Phishing, Targeting Websites and Web-Connected Systems in the Middle East

Khalid Hasan Seum

11 Jan 2026 — 2 min read

The state-linked hacking group MuddyWater has launched a new cyber-espionage campaign deploying a previously undocumented remote access trojan (RAT) known as “RustyWater,” according to recent threat intelligence findings.

The campaign, delivered through spear-phishing emails, has targeted organisations across the Middle East, affecting websites, internal web applications, and internet-facing systems used by government agencies, telecommunications firms, energy companies, and critical infrastructure providers.

Spear-Phishing Leads to Compromise of Web-Connected Environments

Attackers initiate the intrusion by sending highly targeted phishing emails that impersonate legitimate business or government communications. The emails contain malicious document attachments, which, when opened, execute embedded payloads that install the RustyWater malware.

Once deployed, the malware enables attackers to gain remote access to systems that manage websites, web portals, and internal web applications, allowing deeper movement across connected environments.

RustyWater RAT Enables Access to Web and Application Infrastructure

Analysis shows that RustyWater is designed for stealthy, persistent access, particularly within environments that support web services and application hosting.

Capabilities observed include:

Remote command execution on compromised servers
Access to files used by websites and web applications
System and network reconnaissance
Long-term persistence with minimal detection

Security researchers note that RustyWater’s low footprint makes it difficult to detect using basic website monitoring or traditional antivirus tools.

Web-Facing Sectors Among Primary Targets

Affected and targeted organisations include:

Government websites and internal portals
Telecommunications web platforms
Energy and oil & gas web-based systems
Critical infrastructure management applications

The campaign underscores the growing risk to website security and web application security, particularly in sectors where public-facing systems are closely tied to internal networks.

MuddyWater Continues to Exploit Web-Based Attack Surfaces

MuddyWater is known for leveraging email-based social engineering to gain initial access, followed by lateral movement toward web servers, application backends, and administrative panels.

The introduction of RustyWater demonstrates the group’s continued focus on custom malware capable of blending into normal web and application traffic, making detection more challenging.

Ongoing Threat Activity

Threat intelligence teams report that the campaign remains active, with new phishing attempts and infrastructure continuing to emerge. Organisations operating websites or web applications connected to Middle Eastern networks remain at elevated risk.

Security analysts warn that website and web application environments are increasingly being targeted as entry points for long-term cyber-espionage operations.

About Entivel
Entivel develops secure websites, web applications, and custom software solutions, providing cybersecurity, threat intelligence, and penetration testing services for businesses and critical infrastructure operators.

Google Is Ranking Websites Differently Now — Why Many Sites Are Falling Behind | Entivel

Google Is Ranking Websites Differently Now - Many Sites Are Falling Behind

Google is increasingly ranking websites based on how users experience them, rather than relying solely on keywords and backlinks, according to web performance analysts. The shift is leaving many business websites struggling to maintain visibility in search results, even though their content and keywords remain unchanged. Industry observers say the

Hackers Use Over 240 Exploits Before Launching Devastating Ransomware Attacks

Cybercriminal groups are using hundreds of known software vulnerabilities to gain access to corporate networks before deploying ransomware, according to recent cybersecurity research. Security analysts say threat actors have been observed leveraging more than 240 distinct exploits, targeting unpatched systems, outdated software, and exposed services as part of large-scale intrusion

Windows Users Targeted by Malware Masquerading as Adult Game

Cybersecurity researchers have identified a malware campaign targeting Windows users through a malicious installer disguised as an adult-themed game, according to recent analysis. The campaign delivers xRAT, a remote access trojan capable of providing attackers with persistent access to infected systems. Researchers say the malware is being distributed through unofficial

Maduro Arrest Story Used to Spread Dangerous Backdoor Malware

Cybercriminals have leveraged reports surrounding the arrest of Venezuelan President Nicolás Maduro to distribute sophisticated backdoor malware in a targeted phishing campaign, security researchers say. The operation uses a high-profile geopolitical event as social engineering bait to trick recipients into executing malicious software, illustrating how ongoing world news continues to