Adversary Intelligence — 2026-04-23

JUMPSEC ties MuddyWater to TAG-150 CastleRAT platform and previously undocumented ChainShell Node.js agent

A JUMPSEC report links Iran's MOIS-affiliated MuddyWater (Mango Sandstorm) to at least two builds of the Russian-developed TAG-150 CastleRAT commercial malware-as-a-service platform, Cyber Security News reported on April 22. JUMPSEC established the link via an exposed command-and-control server carrying Farsi code comments, Israeli target IP lists, and a PowerShell script named reset.ps1 that deploys ChainShell, a previously undocumented Node.js agent that dynamically resolves C2 addresses via the Ethereum blockchain for takedown resilience. JUMPSEC linked the operator via a shared Amy Cherne code-signing certificate used for both MuddyWater StageComp tooling and CastleRAT installers, and through shared campaign identifier Smokest. No prior public report has tied MuddyWater to a Russian commercial MaaS ecosystem.

Analysis
MuddyWater's confirmed procurement of TAG-150 CastleRAT, anchored by a shared Amy Cherne code-signing certificate linking StageComp tooling to CastleRAT installers and the shared Smokest campaign identifier, per JUMPSEC's technical analysis of an exposed C2 server, breaks the long-standing analytic assumption that clean custom-tool attribution will continue to isolate MOIS-affiliated operations from peer and criminal-ecosystem services. Every defender running Iran-centric detection rules should now add TAG-150 signatures and cross-reference existing criminal-ecosystem intelligence. The certificate link could instead reflect a Russian criminal operator running tooling under contract for MOIS, which shifts the posture from expect TAG-150 in state-espionage incidents to expect multi-tenant tooling with MOIS as one tenant. ChainShell's Ethereum blockchain C2 resolution is the takedown-resilience capability incident responders inside Israeli critical infrastructure will likely encounter in the next 30 days.

2 sources

Iranian Espionage Operations Linked To CastleRAT and ChainShell Malware Suite - Cyber Security News
ChainShell: MuddyWaters Russian MaaS Link - JUMPSEC