{"id":60,"date":"2026-02-26T13:09:26","date_gmt":"2026-02-26T13:09:26","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=60"},"modified":"2026-02-26T13:09:26","modified_gmt":"2026-02-26T13:09:26","slug":"muddywater-targets-mena-organizations-with-ghostfetch-char-and-http_vip","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=60","title":{"rendered":"MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Feb 23, 2026<\/span><\/span>Threat Intelligence \/ Artificial Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The Iranian hacking group known as MuddyWater (aka Earth Vetala, Mango Sandstorm, and MUDDYCOAST) has targeted several organizations and individuals mainly located across the Middle East and North Africa (MENA) region as part of a new campaign codenamed Operation Olalampo<\/strong>.<\/p>\n

The activity, first observed on January 26, 2026, has resulted in the deployment of new malware families that share overlapping samples previously identified as used by the threat actor, according to a report published by Group-IB. These include downloaders like GhostFetch and HTTP_VIP, along with a Rust backdoor called CHAR and an advanced implant codenamed GhostBackDoor that’s dropped by GhostFetch.<\/p>\n

\u00abThese attacks follow similar patterns and align with the killchains previously observed in MuddyWater attacks; starting with a phishing email with a Microsoft Office document attached to it that contains malicious macro code that decodes the embedded payload and drops it on the system and executes it, providing the adversary with remote control of the system,\u00bb the company said<\/a>.<\/p>\n

One such attack chain employing a malicious Microsoft Excel document prompts users to enable macros in order to activate the infection and ultimately drop CHAR. Another variant of the same attack has been found to lead to the deployment of the GhostFetch downloader, which then downloads GhostBackDoor.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

A third version of the attack leverages themes such as flight tickets and reports, in contrast to using lures mimicking an energy and marine services company in the Middle East, to distribute the HTTP_VIP downloader that subsequently deploys the AnyDesk remote desktop software.<\/p>\n

<\/p>\n

A brief description of the four tools is as follows –<\/p>\n