Hackers Tie Iranian Espionage to CastleRAT and ChainShell

A direct operational link between Iran’s MuddyWater espionage group and the Russian TAG-150 CastleRAT malware-as-a-service (MaaS) platform, showing how state and criminal ecosystems are now tightly intertwined.

Investigators recovered 15 malware samples, including at least two CastleRAT “builds” and a PowerShell script named reset.ps1 that deploys a previously undocumented JavaScript/Node.js agent dubbed ChainShell.

On this server, two native PE payloads (“Build 120” and “Build 13”) were concealed inside steganographic JPEG files.

According to JUMPSEC’s analysis, the link hinges on a misconfigured command-and-control (C2) web server hosting Farsi-labeled tooling, Israeli targeting data, and multiple TAG-150 payloads.

They shared hardcoded CastleRAT template identifiers, reinforcing that they originate from the same MaaS codebase. Both samples were compiled shortly before the February 28 U.S.–Israel strikes on Iran, suggesting the tools were pre-staged ahead of expected regional escalation.

ChainShell’s Blockchain-Backed C2

The malware dynamically receives JavaScript from the server using a new Function() construct and executes it on the victim machine, returning results via a custom send routine, rather than embedding fixed capabilities like keyloggers or stealers.

On March 4^th, 2026, researchers at Ctrl-Alt-Intel found a server with an open directory listing that was assessed with high confidence to be MuddyWater.

The code includes Russian-language strings and a system-locale check designed to abort execution on systems in Commonwealth of Independent States (CIS) countries, aligning with TAG-150’s Russian cybercriminal origins and their practice of avoiding infections in the region.

ChainShell is installed by reset.ps1, which first deploys Node.js, decrypts an embedded payload, and then drops the ChainShell components alongside other JavaScript RAT variants.

JUMPSEC assesses that MuddyWater is a customer, not the developer, of the CastleRAT platform, citing Russian-language developer artifacts in core code paths and a CIS locale exclusion that protects Russian environments.

In contrast, the exposed server holds Farsi comments, Israeli IP range lists, and tooling aligned with MuddyWater’s historic Ministry of Intelligence and Security (MOIS) tasking, including Outlook Web Access brute-force scripts.

The CastleRAT ecosystem itself is multi-tenant: other groups such as LeakNet ransomware operators also use the same JavaScript/Deno codebase with different JWT credentials and C2 domains, meaning attribution hinges on infrastructure, certificates, and configurations rather than malware family alone.

Certificate Chain and “Smokest” Campaign

The strongest attribution chain comes from overlapping code-signing certificates and campaign identifiers.

Binaries in the delivery chain are signed with certificates issued under the names “Amy Cherne” and “Donald Gay” from SSL.com, the same material used to sign StageComp, a tool already attributed to MuddyWater by major vendors.

Analysis of an MSI linked to Symantec’s “DinDoor” family shows it contacting the serialmenot.com C2 with a JWT embedding campaignId 75cbe18653d52372, campaignName “Smokest”, and userID bb47c0615477a877 markers that recur across at least six JavaScript RAT variants and in CastleRAT Build 120 and Build 666 scheduled task names (“VirtualSmokestGuy###”).

ChainShell is a thin Node.js execution shell that resolves its C2 endpoint from an Ethereum smart contract via multiple RPC providers, then communicates over AES-256-CBC–encrypted WebSocket channels.

This “Amy Cherne → Smokest JWT → VirtualSmokestGuy” chain bridges vendor-confirmed MuddyWater tooling to CastleRAT’s native PE infrastructure, closing earlier gaps where CastleLoader and DinDoor were observed but not conclusively tied to MOIS operators.

The exposed infrastructure and accompanying artifacts show a clear focus on Israeli IP ranges, Laravel-based web applications, and FortiOS appliances, aligning with MuddyWater’s longstanding regional targeting in government, defense, energy, and telecom sectors.

Activity on the same infrastructure continued into March 2026, with newly compiled installers on March 11, refreshed JavaScript RAT samples on March 16, and a malicious macro document reaching out to MuddyWater C2 on March 20.

For defenders, the convergence of Iranian state targeting with Russian MaaS tradecraft blurs attribution and raises the bar for defense.

Initial triage may misclassify CastleRAT and ChainShell intrusions as purely criminal, delaying an espionage-focused response and underestimating the strategic intent behind campaigns that now combine Hidden VNC, Chrome cookie decryption, and blockchain-resilient C2 under one shared platform.

Indicators of Compromise

SHA256	Description
49f17c061a72cadaf9e3f90cc380e994883a965b7a4ad8953d8e8089c65908e6	CastleRAT Build 120 PE (NOT on VT)
4aaf77c410f1f465d5e9063af60a07ad184e7a92ee87c973c2ea1542bfd66bff	CastleRAT Build 13 PE (NOT on VT)
d91f7a2962c0e9de3cd4ea9c770092d86b1641e89f0a7be2307b6451f00e5271	trfr.jpg stego carrier (Build 13)
94f05495eb1b2ebe592481e01d3900615040aa02bd1807b705a50e45d7c53444	NSIS installer (2026-03-11) — Symantec: Trojan.Fakeset, Microsoft: Trojan:Python/MuddyWater.DB!MTB
a8c380b57cb7c381ca6ba845bd7af7333f52ee4dc4e935e98b48bb81facad72b	NSIS installer (2026-03-13)
7ab597ff0b1a5e6916cad1662b49f58231867a1d4fa91a4edf7ecb73c3ec7fe6	reset.ps1 (ChainShell deployer)
c8589ca999526f247db4d3902ade8a85619f8f82338c6230d1b935f413ddcb3d	VfZUSQi6oerKau.js (ChainShell dropper/installer)
bedb882c6e2cf896e14ecf12c90aaa6638f780017d1b8687a40b4a81956e230f	sysuu2etiprun.js (ChainShell blockchain C2 agent)
3df9dcc45d2a3b1f639e40d47eceeafb229f6d9e7f0adcd8f1731af1563ffb90	HVNC WebView2 browser component — Symantec: Trojan.Darkcomp
a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0	StageComp (named “DIDS”) — Symantec: Trojan.StageComp, Microsoft: Trojan:Python/MuddyWater.DB!MTB

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.