GhostFetch
GhostFetch is a downloader malware family associated with the Iranian MOIS-linked threat actor MuddyWater and documented as part of Operation Olalampo, first observed from January 26, 2026. It is described as a stealthy first-stage downloader used in phishing-led intrusion chains, typically delivered via malicious Microsoft Office lure documents that require victims to enable macros. Reporting also states MuddyWater exploited recently disclosed vulnerabilities on public-facing servers for initial access during the broader campaign.
GhostFetch is used for in-memory execution of staged payloads and is characterized as a first-stage downloader that profiles the victim system before fetching and executing secondary payloads. Reported anti-analysis and evasion behavior includes validating mouse movement, checking screen resolution, and checking for debuggers, virtual machine artifacts, and antivirus software. Multiple sources state that GhostFetch can deploy a second-stage implant named GhostBackDoor. GhostBackDoor is described as providing interactive shell access, file read/write or file manipulation capabilities, and the ability to re-run GhostFetch.
Within Operation Olalampo, GhostFetch appeared alongside other MuddyWater malware families including HTTP_VIP, GhostBackDoor, and the Rust-based CHAR backdoor, with CHAR reportedly controlled via a Telegram bot. The campaign primarily targeted organizations and individuals across the Middle East and North Africa, and broader reporting linked MuddyWater’s 2026 activity to targeting in Israel, Egypt, the UAE, Turkmenistan, and sectors including diplomatic, maritime, financial, telecom, government, and critical infrastructure. Additional reporting cited deployment of MuddyWater implants including GhostFetch into Israeli government networks and U.S. systems.
High-confidence infection chains described in the source material include lure document -> GhostFetch -> GhostBackDoor, with GhostFetch functioning as the initial downloader and memory-resident stager. No GhostFetch-specific hashes or network indicators were provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MuddyWater's Operation Olalampo deployed GhostFetch as a first-stage in-memory downloader...
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
2 techniques
Execution
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
Persistence
1 technique
Persistence
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
Privilege Escalation
1 technique
Privilege Escalation
MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.
Stealth
3 techniques
Stealth
Defense Evasion: Obfuscation, reflective loading, disabling security tools, living-off-the-land (T1027, T1620, T1562).
Discovery
2 techniques
Discovery
Command and Control
3 techniques
Command and Control
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A first-stage in-memory downloader used by MuddyWater in Operation Olalampo.
A Rust-based implant reportedly used by MuddyWater for pre-positioning and long-term access into Israeli government networks and US systems.
Tool/malware family cited as part of MuddyWater's January 2026 Operation Olalampo, associated with phishing delivery, staged payloads, and anti-sandbox behavior.
A malware component used for in-memory execution as part of an Olalampo attack chain leading to GhostBackDoor.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.