CHAR
CHAR is a Rust-based backdoor associated with the Iranian state-linked threat actor MuddyWater, including activity tracked as Operation Olalampo. Reporting places its use from at least January 2026 in campaigns primarily targeting organizations and individuals in the Middle East and North Africa, with broader reporting linking MuddyWater targeting to sectors including energy, maritime, diplomatic, financial, telecom, and critical infrastructure. In documented attack chains, CHAR was delivered via phishing emails with malicious Microsoft Office or Excel documents that relied on macro execution; reporting also states MuddyWater exploited recently disclosed vulnerabilities on public-facing servers for initial access during the same campaign. CHAR uses Telegram for command and control via the bot identified as stager_51_bot, also described as the Telegram bot with first name "Olalampo." Its confirmed capabilities include changing directories and executing cmd.exe or PowerShell commands. Reported PowerShell tasking included execution of a SOCKS5 reverse proxy, another backdoor named Kalim, browser-data theft/upload activity, and running executables named sh.exe and gshdoc_release_X64_GUI.exe. Multiple sources describe CHAR as part of a broader MuddyWater toolset alongside GhostFetch, HTTP_VIP, GhostBackDoor, RustyWater, Phoenix, and Fooder loader. Group-IB reported signs of possible AI-assisted development in CHAR-related tooling, specifically emojis in debug strings, and noted structural similarities to the Rust-based BlackBeard malware family, also referred to as Archer RAT and RUSTRIC.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
MuddyWater's Operation Olalampo deployed... CHAR, a Rust-based backdoor controlled via Telegram bot stager_51_bot...
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
4 techniques
Execution
"GhostBackDoor... supports an interactive shell"; "...retrieve instructions to start an interactive shell"
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
3 techniques
Stealth
Defense Evasion: Obfuscation, reflective loading, disabling security tools, living-off-the-land (T1027, T1620, T1562).
Credential Access
2 techniques
Credential Access
Discovery
1 technique
Discovery
Command and Control
8 techniques
Command and Control
Sekoia TDR (July 2024) independently documented the same implant under the name MuddyRot, with matching characteristics: mutex “DocumentUpdater,” TCP port 443, and identical string obfuscation logic.
TWINTALK, a C2 orchestrator that beacons via JWT-authenticated HTTPS with randomized delays (108–180 seconds).
Excel lure (energy/maritime company) -> CHAR (Rust backdoor with Telegram C2).
Command and control operates through Telegram dead drops, JWT-authenticated HTTPS with randomized URI paths, and Cloudflare-fronted infrastructure that masks backend servers from conventional blocking.
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-based backdoor used by MuddyWater and controlled through a Telegram bot; debug strings suggest AI-assisted code generation.
Named tool/malware referenced as part of MuddyWater's Operation Olalampo in January 2026.
A Rust backdoor with Telegram-based command and control used in Operation Olalampo.
A Rust-based backdoor attributed in the article to MuddyWater activity, aligned with stealthy access, persistence, and covert C2 (noted as Telegram-based in the campaign description).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.