MuddyWater Adopts Russian CastleRAT Malware-as-a-Service

A significant operational shift has been identified where the Iranian state-sponsored group MuddyWater (affiliated with the MOIS) has integrated Russian-developed Malware-as-a-Service (MaaS) into its espionage toolkit. Evidence from a misconfigured C2 server (157.20.182[.]49) and certificate analysis reveals that MuddyWater is a customer of the TAG-150 platform, utilizing modular malware including the native CastleRAT and a novel blockchain-based Node.js agent dubbed 'ChainShell'.

The attack chain involves the use of compromised code-signing certificates (e.g., 'Amy Cherne') to deliver multi-stage payloads including StageComp, CastleLoader, and eventually persistent RATs. By adopting commercial MaaS tools, MuddyWater has upgraded its technical capabilities to include Hidden VNC (HVNC), Chrome v127+ cookie encryption bypassing, and blockchain-resilient C2 infrastructures, making their operations harder to disrupt and more likely to be misattributed to Russian cybercrime.

This convergence of state-level targeting with sophisticated, commercially available offensive tooling increases the risk to the defense, aerospace, and energy sectors. The use of steganography and scheduled tasks for persistence highlights a move toward more evasive tradecraft intended to maintain long-term access to high-value targets.