Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
MalwareUsed by 1 actor

GhostFetch

GhostFetch is a downloader malware family associated with the Iranian MOIS-linked threat actor MuddyWater and documented as part of Operation Olalampo, first observed from January 26, 2026. It is described as a stealthy first-stage downloader used in phishing-led intrusion chains, typically delivered via malicious Microsoft Office lure documents that require victims to enable macros. Reporting also states MuddyWater exploited recently disclosed vulnerabilities on public-facing servers for initial access during the broader campaign.

GhostFetch is used for in-memory execution of staged payloads and is characterized as a first-stage downloader that profiles the victim system before fetching and executing secondary payloads. Reported anti-analysis and evasion behavior includes validating mouse movement, checking screen resolution, and checking for debuggers, virtual machine artifacts, and antivirus software. Multiple sources state that GhostFetch can deploy a second-stage implant named GhostBackDoor. GhostBackDoor is described as providing interactive shell access, file read/write or file manipulation capabilities, and the ability to re-run GhostFetch.

Within Operation Olalampo, GhostFetch appeared alongside other MuddyWater malware families including HTTP_VIP, GhostBackDoor, and the Rust-based CHAR backdoor, with CHAR reportedly controlled via a Telegram bot. The campaign primarily targeted organizations and individuals across the Middle East and North Africa, and broader reporting linked MuddyWater’s 2026 activity to targeting in Israel, Egypt, the UAE, Turkmenistan, and sectors including diplomatic, maritime, financial, telecom, government, and critical infrastructure. Additional reporting cited deployment of MuddyWater implants including GhostFetch into Israeli government networks and U.S. systems.

High-confidence infection chains described in the source material include lure document -> GhostFetch -> GhostBackDoor, with GhostFetch functioning as the initial downloader and memory-resident stager. No GhostFetch-specific hashes or network indicators were provided in the content.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
MuddyWater

MuddyWater's Operation Olalampo deployed GhostFetch as a first-stage in-memory downloader...

via centripetal threat researchcentripetal.ai
MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques
T1566PhishingEvidence3

From February to July 2024, more than 50 phishing emails were observed across 10+ sectors with hundreds of recipients.

T1566.001Spearphishing AttachmentEvidence6

Initial Access: Spear-phishing with malicious Word docs/VBA macros (T1566.001), macro execution (T1204.002).

Execution

2 techniques
T1053Scheduled Task/JobEvidence1

MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.

T1204.002Malicious FileEvidence6

Initial Access: Spear-phishing with malicious Word docs/VBA macros (T1566.001), macro execution (T1204.002).

Persistence

1 technique
T1053Scheduled Task/JobEvidence1

MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.

Privilege Escalation

1 technique
T1053Scheduled Task/JobEvidence1

MuddyWater, the long-standing MOIS-linked advanced persistent threat group, quietly deployed Rust-based implants known as GhostFetch, RustyWater and Dindoor into Israeli government networks and US systems as part of ongoing Operation Olalampo positioning. This phase represented classic pre-positioning, where state-sponsored advanced persistent threats prepared long-term access.

Stealth

3 techniques
T1027Obfuscated Files or InformationEvidence1

Defense Evasion: Obfuscation, reflective loading, disabling security tools, living-off-the-land (T1027, T1620, T1562).

T1497Virtualization/Sandbox EvasionEvidence1

"...checks for the presence of debuggers, virtual machine artifacts, and antivirus software..."

T1620Reflective Code LoadingEvidence2

Lure document -> GhostFetch (memory execution) -> GhostBackDoor.

Discovery

2 techniques
T1082System Information DiscoveryEvidence2

"GhostFetch... profiles the system... checks screen resolution..."; "HTTP_VIP... conducts system reconnaissance"

T1497Virtualization/Sandbox EvasionEvidence1

"...checks for the presence of debuggers, virtual machine artifacts, and antivirus software..."

Command and Control

3 techniques
T1071.001Web ProtocolsEvidence2

Command & Control / Exfiltration: Custom C2 (HTTP, encrypted channels), data staging (T1071.001, T1041).

T1102.002Bidirectional CommunicationEvidence1

"The campaign used phishing, post-exploitation tooling, and Telegram-based command and control..."

T1105Ingress Tool TransferEvidence3

MuddyWater maintained its Rust backdoors into US banks, airports and Israeli defence software companies.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

Command & Control / Exfiltration: Custom C2 (HTTP, encrypted channels), data staging (T1071.001, T1041).

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app3 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.