Adversary Intelligence — 2026-06-01

Iranian MuddyWater Adopts Russian Cybercrime MaaS Platform in ChainShell Campaign Targeting Israel

BLUFMuddyWater's purchase of Russian criminal tooling likely presages further ChainShell operations against Israeli targets within 90 days, with blockchain-based C2 degrading traditional network defenses.

JUMPSEC researchers documented MuddyWater as a paying customer of TAG-150's CastleRAT malware-as-a-service ecosystem, a Russian-speaking criminal platform, targeting Israeli organizations 123. A misconfigured C2 server at 157.20.182.49 exposed 15 malware samples, Farsi-language code comments, and Israeli IP range lists 13. Attribution rests on SSL.com certificates issued to "Amy Cherne," previously linked to MuddyWater's StageComp tool, and JWT identifiers matching the "Smokest" operation 2. The novel ChainShell payload, a Node.js implant, resolves C2 via Ethereum smart contracts and communicates over AES-256-CBC encrypted WebSocket channels, with all active capabilities delivered at runtime 13. Ctrl-Alt-Intel identified the exposed server in early March 2026; MuddyWater continued compiling new installers on March 11, updating JavaScript malware on March 16, and deploying a macro lure on March 20 3.

Analysis
MuddyWater operating as a paying customer within a Russian criminal MaaS ecosystem compresses the gap between strategic intent and operational deployment for MOIS-affiliated actors, a pattern confirmed across multiple state services by SideCopy's concurrent XenoRAT sourcing against Afghan finance targets. ChainShell's Ethereum-based C2 resolution defeats sinkholing, forcing detection toward behavioral indicators. Defenders encountering CastleRAT artifacts without full campaign context will typically misattribute the activity to Russian criminal operations rather than Iranian state espionage. The exposed server may represent deliberate staging to implicate Iranian operators rather than genuine operational error. A further publicly attributed ChainShell campaign is likely within 90 days given the MaaS model's low redeployment cost, making behavioral detection investment the priority over signature-based IOC rules. Moderate confidence reflects a single primary technical investigation without independent corroboration.

4 sources