MuddyWater Operation Olalampo campaign targeting MENA organizations and individuals
Campaign
Summary
Hide ▲
Show ▼
The MuddyWater campaign Operation Olalampo is actively targeting organizations and individuals across MENA, creating ongoing risk of remote compromise and follow-on intrusion. First observed on January 26, 2026, the operation uses phishing emails with malicious Microsoft Office documents to deliver custom tooling. The toolkit includes GhostFetch, HTTP_VIP, CHAR, and GhostBackDoor, and one variant also deploys AnyDesk. The campaign matters because it combines macro-based delivery, remote-control payloads, and exploitation of recently disclosed vulnerabilities on public-facing servers to gain access.
Related Happenings
Secret Blizzard Kazuar modular P2P botnet
Malware Activity
H score28
First: 16.05.2026 17:15
Last: 16.05.2026 17:15
Sources 1
About this happening:
Kazuar is being used in a multi-stage campaign in Ukraine that ESET says likely involves Gamaredon providing access and Turla/Secret Blizzard delivering the ba...
Secret Blizzard Kazuar modular P2P botnet
Malware ActivityAbout this happening: Kazuar is being used in a multi-stage campaign in Ukraine that ESET says likely involves Gamaredon providing access and Turla/Secret Blizzard delivering the ba...
MuddyWater broad cyber-espionage campaign across sectors and countries
Campaign
H score37
First: 14.05.2026 00:59
Last: 14.05.2026 00:59
Sources 1
About this happening:
MuddyWater was tied to a 2026 espionage campaign affecting at least nine organizations across nine countries on four continents, with victims in industrial a...
MuddyWater broad cyber-espionage campaign across sectors and countries
CampaignAbout this happening: MuddyWater was tied to a 2026 espionage campaign affecting at least nine organizations across nine countries on four continents, with victims in industrial a...
APT28 Operation GhostMail Zimbra phishing campaign targeting Ukrainian government entities
Campaign
H score37
First: 19.03.2026 16:55
Last: 19.03.2026 16:55
Sources 1
About this happening:
APT28’s Operation GhostMail is actively targeting Ukrainian government entities through a phishing chain that exploits CVE-2025-66376 in Zimbra Collaboration Sui...
APT28 Operation GhostMail Zimbra phishing campaign targeting Ukrainian government entities
CampaignAbout this happening: APT28’s Operation GhostMail is actively targeting Ukrainian government entities through a phishing chain that exploits CVE-2025-66376 in Zimbra Collaboration Sui...
Dindoor backdoor activity in MuddyWater operations
Malware Activity
H score23
First: 06.03.2026 17:15
Last: 06.03.2026 17:15
Sources 1
About this happening:
Researchers identified Dindoor, a previously unknown backdoor, on targeted networks tied to MuddyWater, showing the group was using a new intrusion toolset. The malware ap...
Dindoor backdoor activity in MuddyWater operations
Malware ActivityAbout this happening: Researchers identified Dindoor, a previously unknown backdoor, on targeted networks tied to MuddyWater, showing the group was using a new intrusion toolset. The malware ap...
APT28 wellnesscaremed[.]com multistage LNK campaign
Campaign
H score36
First: 02.03.2026 12:36
Last: 02.03.2026 12:36
Sources 1
About this happening:
An APT28-linked LNK/HTML delivery chain is being used for multistage payloads, indicating an ongoing phishing-style operation that can broaden exploitation paths. The...
APT28 wellnesscaremed[.]com multistage LNK campaign
CampaignAbout this happening: An APT28-linked LNK/HTML delivery chain is being used for multistage payloads, indicating an ongoing phishing-style operation that can broaden exploitation paths. The...
Timeline
-
23.02.2026 09:25 2 articles · 4mo ago
Operation Olalampo phishing and malware delivery
Campaign Scope UpdateMuddyWater's Operation Olalampo targets organizations and individuals mainly in the MENA region by sending phishing emails with malicious Microsoft Office or Microsoft Excel attachments that prompt macro execution and deliver GhostFetch, HTTP_VIP, CHAR, GhostBackDoor, and, in one variant, AnyDesk.
Show sources
- MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP — thehackernews.com — 23.02.2026 09:25
- MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP — thehackernews.com — 23.02.2026 09:25
-
23.02.2026 09:25 1 articles · 4mo ago
Group-IB analysis of CHAR and server exploitation
Technical Analysis UpdateGroup-IB's analysis of MuddyWater's CHAR backdoor found signs of AI-assisted development in debug strings and noted that the group is exploiting recently disclosed vulnerabilities on public-facing servers to obtain initial access to target networks.
Show sources
- MuddyWater Targets MENA Organizations with GhostFetch, CHAR, and HTTP_VIP — thehackernews.com — 23.02.2026 09:25