The World Through the Screens of Iran’s Intelligence Ministry Hackers
Two defensive simulations of MuddyWater operations show that the power of the Islamic Republic’s hackers does not lie in any single mysterious technology. It comes from combining close knowledge of the target, the exploitation of trust, and a handful of relatively simple technical tools.
Abdelrahman Ali, who publishes under the name S3N4T0R-0X0, is an offensive-security researcher and engineer based in Alexandria, Egypt. His work focuses on simulating the behavior of cyber threat actors and developing custom malware and tools based on real-world malicious activity, particularly advanced threats linked to Russia, China, North Korea, and Iran. His open-source projects—especially BEAR-C2 and APTs-Adversary-Simulation—offer an unusual window into how such operations work.
Advanced persistent threat, or APT, simulation is the controlled reconstruction of an offensive operation: from a phishing document and malicious code execution to contact with command-and-control infrastructure and an attacker’s access to information on the target computer.
Two of S3N4T0R-0X0’s simulations examine operations conducted by actors linked to Iran’s Ministry of Intelligence and Security, or MOIS. Both begin with a weaponized Microsoft Office document. If successful, they progress to system reconnaissance, command execution, and file management.
The principal actor in both cases is MuddyWater, a group also tracked as Boggy Serpens, Mercury, Seedworm, and Static Kitten. The FBI, US Cyber Command, the US National Security Agency, and the UK National Cyber Security Centre have assessed MuddyWater to be subordinate to Iran’s Ministry of Intelligence and Security.
Act One: An Excel File Opens a Door to MuddyWater’s Control Room
Security company Group-IB first observed Operation Olalampo in January 2026 and attributed it to MuddyWater with high confidence. RaazNet previously examined the fourth generation of the Phoenix malware in “Phoenix: Iran’s Homegrown Spyware.” Researchers at Unit 42 also documented four waves of attacks over six months against a Middle Eastern energy and maritime services company.
The attacks began with malicious Word and Excel files and could deploy four different tools on a target computer: CHAR, GhostFetch, HTTP_VIP, and GhostBackDoor. This simulation focuses on CHAR, a program that establishes a covert channel for remote access after a machine has been compromised.
The success of an operation like this depends less on the technical sophistication of the malware than on choosing the right victim and the right lure. The attacker must know what kind of file would look ordinary—and important enough to open—to an engineer, accountant, or diplomat. The first stage of the attack is therefore often not writing code, but collecting information about the target’s job, organization, and professional relationships.
In one attack wave, the malicious document used specialized terminology about subsea pipelines and was designed for project engineers. In another, an Excel file resembled an internal financial report, referring to payroll, cash flow, engineering services, and the United Arab Emirates dirham. Airline tickets and consumption reports served as lures in other attacks.
None of these details was accidental. A finance employee would not normally regard a payment report as inherently suspicious. A project engineer is expected to review a progress report. A diplomat cannot ignore every formal invitation. The attacker constructs a document that fits into the victim’s everyday professional life. The victim’s trust thus becomes the first tool in the attack—before security software has had a chance to respond.
In some cases, MuddyWater first compromised a real email account and then used that now-controlled intermediary account to send malicious messages to subsequent targets. In one example, an invitation concerning the future of the Middle East after the Iran–Israel war was sent from an account belonging to Oman’s Ministry of Foreign Affairs to embassies, government ministries, and international organizations.
Lures Tailored to Their Targets
The short simulation video shows how ordinary the opening stage of the attack can appear. The user opens an Excel file but, instead of the expected information, sees a blurred page and a message claiming that the document was created in an older version of Office. To view it, the user must accept two warnings at the top of the screen. Those two clicks are enough to give the document permission to execute commands that Office would normally block.
The instructions are embedded in the file as a macro. Macros are a legitimate Word and Excel feature designed to automate repetitive tasks—for example, performing calculations or applying formatting with a single click. An attacker, however, can abuse the same feature to download and execute a malicious program.
After the document is opened, the macro performs four main actions. It first checks whether the attacker’s required file already exists on the computer. It then reveals a web address concealed in the code. If necessary, it downloads the principal malware file. Finally, it runs that file without displaying an obvious window to the user. The victim is still waiting for the spreadsheet’s contents to appear while another program has already begun running in the background.
The Malicious Macro in Four Stages
The program launched at the end of this process is called CHAR. It is a backdoor: a covert access route that remains open after the initial compromise and allows the attacker to issue instructions to the target computer without being physically present. CHAR is written in the Rust programming language, but its more distinctive feature is its use of Telegram as a communications channel.
Telegram plays a role here that is very different from ordinary messaging. The attacker sends a command through a Telegram bot; the program installed on the victim’s computer receives and executes it, then returns the result through the same channel. Put simply, the bot acts as a courier between the attacker and the compromised machine.
This connection allows the operator to run commands, browse directories, and download, move, delete, or upload files. If the collected data is too large for a single Telegram message, CHAR splits it into smaller chunks and sends it across multiple messages.
In the control interface, the computer first identifies itself through several details: the device name, username, position within the organization’s network, and the directory in which the program is located. The attacker can then query the computer’s contents and view the response to each command. Every response exposes another fragment of the victim’s location and activity.
Telegram and the Simulated Control Room
The second simulation video presents the other side of the connection. Once CHAR is ready, the laboratory machine appears in the control panel, where the operator can send it messages and receive responses. The long, apparently meaningless strings moving across the screen are packaged commands and replies. The program prepares them for transmission through Telegram, and they are converted back into readable text at the destination.
The interface presents “the victim’s world through the attacker’s eyes,” but it should not be mistaken for the actual interface used by MuddyWater. BEAR-C2 was created by S3N4T0R-0X0 and forms part of the simulation environment. What has been reconstructed is the logic of the operation: the compromised computer identifies itself, receives a command, and returns the result.
Reaching the control panel shown at the end of the video depends on the success of several earlier stages. The attacker must research the target, compromise or convincingly imitate a trusted account, create an appropriate lure, get the message past security filters, persuade the victim to open the document and enable its content, and finally evade the computer’s protective systems long enough to run the malware.
MuddyWater’s use of Telegram also produced an unintended consequence. Group-IB researchers were able to monitor part of the bot’s activity and observe the tools and actions used by operators during periods in late 2025 and early 2026. Infrastructure intended to give the attacker a window into the victim’s computer also created visibility in the opposite direction for cybersecurity researchers. Group-IB and Unit 42 researchers also found signs in parts of the code suggesting that AI tools may have been used in its development.
The lesson is that the operation’s power does not lie in any single mysterious technology. It emerges from a combination of detailed knowledge about the target, the exploitation of trust, and a handful of relatively simple technical tools.
Act Two: A Rusty Soldier Disguised as Reddit
The second operation begins with an email that looks even less dangerous than the financial reports in the first: “Updated Cybersecurity Guidelines.” Security company CloudSEK identified the attack in January 2026. The message came from an address that appeared to be associated with Turkmenistan’s primary mobile operator and carried an attachment named Cybersecurity.doc. The email warned its recipient about security, but opening the attachment could undermine the security of the entire computer.
The espionage tool used in this attack is called RustyWater. Closely related samples had previously been identified as Archer RAT and RUSTRIC. The main difference between this tool and much of MuddyWater’s older malware was more than a name or a new appearance. For years, the group had relied heavily on script files and built-in Windows commands. RustyWater, by contrast, was built as a standalone program capable of carrying out multiple tasks at once, inspecting the computer environment, maintaining access, and communicating with the attacker.
The main malware was not attached to the email in its normal executable form. Instead, the attackers converted it into a long string of letters and numbers and concealed it within an internal section of the Word file. The data were invisible to the user, but a macro inside the document could read the string and reconstruct it as an executable file. Once opened, the Word document assembled the hidden data and extracted a runnable program from what appeared to be an ordinary office file.
From a Security Email to an Extracted Malware File
After it is launched, RustyWater does not immediately begin searching through the victim’s files. It first tries to understand what kind of computer it has reached. What are the device and user names? Which organizational network does the machine belong to? What security programs are installed? Most importantly, has the malware reached the computer of a real employee, or an environment built by researchers to study malicious software?
RustyWater looks for signs of a virtual machine, software capable of inspecting or interrupting code execution, and the length of time the computer has been running. If the combined answers appear abnormal, the malware can halt its principal activity so that there is less behavior for researchers to record and analyze. Researchers identified anti-analysis capabilities in RustyWater, including checks for traces of more than 25 security products.
A Real Victim or a Laboratory Machine?
If the computer passes these checks, RustyWater uses another trick to conceal itself and retain access: it presents itself as reddit.exe while displaying the Cloudflare logo as its icon. The combination of two familiar names is deliberate. If a user or network administrator happens to see the file, they may associate it with a legitimate, recognizable internet service.
The disguise is hardly flawless: Reddit and Cloudflare are separate brands. But the attacker is not counting on every file being scrutinized. The goal is for the name and icon to look ordinary enough at a glance. The same technique used in the email—borrowing the identity of a trusted sender—is repeated inside the computer by borrowing the identities of two familiar companies.
RustyWater then attempts to maintain access after the computer is restarted. It adds itself to the list of applications Windows launches automatically when a user signs in. In the simulation, the entry is given a name resembling a Windows update component so that it attracts less attention.
The next stage is to hide inside an ordinary Windows process. RustyWater executes part of its code within explorer.exe, the program that manages the desktop, taskbar, and file windows. As a result, the malware’s activity may appear externally under the name of a routine system process. This technique is known as process injection: rather than always operating under its own name, the malicious program performs some of its work under the cover of a trusted process.
Once it has established access, RustyWater contacts the attacker’s server. The connection uses the same general method that carries information across the web, but the contents of its messages are transformed several times before transmission so that they are not readable during superficial inspection. The computer prepares information such as the username, device name, position within the network, and command results, then sends it to the server.
The timing of these connections is not fixed. If a computer contacts an unknown address precisely every 30 seconds, security tools can more easily detect the pattern. RustyWater varies the intervals between connections in an attempt to make its behavior less regular. At the same time, it can receive commands, manipulate files, and prepare new information for transmission.
A False Identity, Persistent Access, and the Control Room
The Technology Comes Last; Trust Comes First
The two simulations examined in this report use different tools. In the first case, CHAR moves commands through a Telegram bot. In the second, RustyWater communicates directly with an internet server, inspects the computer environment more carefully, and makes greater efforts to conceal itself and maintain access. Yet the underlying logic of the two attacks is much the same.
Both operations begin with an understanding of the victim’s professional life. One sends financial and engineering reports to an employee of an energy company; the other sends cybersecurity guidance to an employee of a telecommunications provider. The subjects differ, but the purpose is the same: to turn an ordinary workplace responsibility into a reason to open a document and bypass security warnings.
Both chains therefore depend on a series of fragile successes: correctly identifying the victim, gaining access to a trusted account, crafting a suitable lure, getting the message through security filters, and ultimately persuading the user to open the document and enable its content.
Technology comes at the end of this chain; trust is at the beginning. The attacker approaches the victim in the language of their profession. Only after winning that trust can the attacker reduce the person’s digital life to a few lines of information inside a control room.