External/APTs-Adversary-Simulation
1
0
Fork 0
mirror of https://github.com/S3N4T0R-0X0/APTs-Adversary-Simulation.git synced 2026-08-04 09:41:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
S3N4T0R
2026-05-03 17:36:19 -04:00
committed by GitHub
parent 5ee2f93a7f
commit 87889a0141
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Iranian APT/Charming Kitten/README.md
+5 -3
View File
@@ -15,6 +15,11 @@ and Group-IB: https://www.group-ib.com/blog/muddywater-operation-olalampo/
<img width="1262" height="700" alt="word-image-341009-175304-1-1262x700" src="https://github.com/user-attachments/assets/78362455-3c93-4a60-88ec-6132d407f166" />
In this campaign, the blurred document lure delivers a new payload as a custom HTTP backdoor. To maintain persistence, the group has evolved its development approach by leveraging AI-generated code and Rust-based tools, such as the BlackBeard backdoor, to rapidly deploy custom implants. Additionally, the group uses standard HTTP status codes, customized UDP based traffic, and the Telegram API for C2 communications.
<img width="689" height="578" alt="Screenshot 2026-05-03 at 17-06-02 Operation Olalampo Inside MuddyWater’s Latest Campaign Group-IB Blog" src="https://github.com/user-attachments/assets/dc9ea0ba-0c97-42ff-af21-fb6ab4f8c28c" />
## The first stage (delivery technique)
The initial campaign targeted project engineers using industry-specific terminology for subsea pipelines. The lure document was blurred in order to deceive targets into clicking “Enable Content” thereby triggering the execution of the embedded macro.
@@ -30,7 +35,4 @@ The infected document included specific references to “Engineering, Constructi
In this campaign, the blurred document lure delivers a new payload as a custom HTTP backdoor. To maintain persistence, the group has evolved its development approach by leveraging AI-generated code and Rust-based tools, such as the BlackBeard backdoor, to rapidly deploy custom implants. Additionally, the group uses standard HTTP status codes, customized UDP based traffic, and the Telegram API for C2 communications.
<img width="689" height="578" alt="Screenshot 2026-05-03 at 17-06-02 Operation Olalampo Inside MuddyWater’s Latest Campaign Group-IB Blog" src="https://github.com/user-attachments/assets/dc9ea0ba-0c97-42ff-af21-fb6ab4f8c28c" />