CloudSEK_RustyWater_Jan2026

RustyWater has an obfuscated function (i.e. love_me__()) that dynamically reconstructs the string WScript.Shell using hard-coded ASCII values and the Chr() function.

RustyWater has encrypted all strings in the code using position independent XOR encryption.

RustyWater has gathered the victim machine’s username.

RustyWater has used reddit.exe as its file name and a Cloudflare logo.

RustyWater has injected its shellcode into explorer.exe by allocating memory via `VirtualAllocEx`, then by writing the payload via `WriteProcessMemory`.

RustyWater has used the Rust request library for HTTP C2 communication.

RustyWater has gathered the victim machine’s computer name.

RustyWater has gathered the domain membership of the victim machine’s user.

RustyWater has used `CreateObject` to instantiate a WScript.Shell Component Object Model (COM) object.  Additionally, RustyWater has used `VirtualAllocEx` and `WriteProcessMemory` to inject shellcode into explorer.exe.

RustyWater has encoded collected data with Base64.

RustyWater has used the WriteHexToFile function to transform an embedded hex string to the payload CertificationKit.ini.

MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

RustyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.

RustyWater has attempted to detect more than 25 antivirus and EDR tools.

RustyWater has established persistence by adding `C:\ProgramData\CertificationKit.ini` to a Windows startup Registry key or to a Run or RunOnce Registry key.

RustyWater has used a WScript.Shell COM object to execute the CertificationKit.ini file.

RustyWater has sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primary payload for the next stage.

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.

RustyWater has encrypted encoded data with XOR before sending it to the C2 server.

RustyWater has registered a Vectored Exception Handler (VEH) to catch debugging efforts.

RustyWater has generated random sleep intervals between C2 communication.

MuddyWater has used support@microsoftonlines[.]com to send phishing emails that masqueraded as security updates from Microsoft. MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.

RustyWater has impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain `info@tmcell`.