MuddyWater is now weaponizing a Russian malware-as-a-service (MaaS) platform to run a new operation dubbed “ChainShell”, blending Iranian state targeting with commercially developed cybercrime tooling.
The assessment is based on a misconfigured command‑and‑control (C2) web server, 15 malware samples, and a previously undocumented JavaScript/Node.js payload named ChainShell.
Investigators conclude that MuddyWater is running at least two CastleRAT builds against Israeli targets and deploying additional TAG-150 JavaScript RAT variants from the same exposed infrastructure.
JUMPSEC has documented a direct operational link between infrastructure attributed to the Iranian espionage group MuddyWater and TAG-150’s CastleRAT MaaS platform, which is developed and maintained by Russian-speaking criminals.
This places a traditionally state-directed actor as a paying customer inside a multi-tenant Russian MaaS ecosystem rather than the owner of the tooling.
The key artifact tying the operation together is reset.ps1, a PowerShell deployer script recovered from a MuddyWater-attributed C2 at 157.20.182.49 that contains Farsi comments and Israeli IP ranges for targeting.
The script installs Node.js, AES-decrypts an embedded payload, and launches two components: sysuu2etiprun.js, a blockchain-based C2 agent, and VfZUSQi6oerKau.js, a dropper/installer.
The code implements a thin “execution shell” model where the server pushes arbitrary JavaScript via new Function() and receives results via a callback, leaving no built-in stealer or keylogger capabilities in the client.
Alongside ChainShell, analysts uncovered two native CastleRAT payloads labelled “Build 120” and “Build 13”, which were embedded inside steganographic JPEG images on the same C2 host.
Both binaries share hardcoded template identifiers (including strings such as “IsabellaWine”), confirming they originate from the TAG-150 MaaS codebase and were compiled only 48 hours apart.
Timeline analysis shows MuddyWater continuing to use this infrastructure even after vendors exposed aspects of the campaign: new delivery installers appeared on March 11, updated JavaScript RAT samples on March 16, and a malicious macro document contacting MuddyWater C2 as late as March 20.
All of the payloads preserve TAG-150’s templated builder constants while rotating campaign IDs and build numbers for each operation.
Attribution to MuddyWater hinges on a detailed certificate and configuration trail that connects TAG-150 tooling back to known MuddyWater implants.
The JavaScript malware alone does not prove MuddyWater attribution; the attribution rests on the Amy Cherne certificate chain and the 157 server.
Code-signing certificates issued under the names “Amy Cherne” and “Donald Gay” by SSL.com were used to sign StageComp, a tool already attributed to MuddyWater by multiple vendors, as well as MSI installers delivering the CastleLoader/CastleRAT chain.
Behavioural analysis of these installers shows them reaching the multi-tenant serialmenot.com C2 with JSON Web Tokens (JWTs) containing a “Smokest” campaign ID and userID bb47c0615477a877, identifiers that also appear inside Build 120 and Build 666 scheduled task names such as “VirtualSmokestGuy120”.
JUMPSEC has named this previously undocumented Node.js agent “ChainShell”, noting that it resolves its C2 endpoint from an Ethereum smart contract through multiple RPC providers and communicates via AES-256-CBC–encrypted WebSocket traffic.
JUMPSEC further reinforce the link with bash history from the 157.20.182.49 server showing explicit self-tests of CastleRAT C2 ports 9999 (Build 120) and 8888 (Build 13).
MuddyWater, also tracked as Seedworm, Mango Sandstorm, TA450, and Static Kitten, is an Iranian MOIS-linked espionage group active since at least 2017 that regularly targets government, defence, telecommunications, and energy organisations across the Middle East and the West.
Its latest shift from custom PowerShell backdoors and off-the-shelf remote monitoring tools toward TAG-150’s professionalised platform gives the group rapid access to capabilities such as Hidden VNC, credential theft, and advanced browser data exfiltration without long development cycles.
For defenders, the adoption of Russian criminal tooling by an Iranian state actor complicates incident response, as early triage based on malware families alone may misclassify intrusions as Russian cybercrime rather than state-backed espionage.
Organisations in defence, aerospace, energy, and government especially those in Israel and surrounding regions should treat CastleRAT, CastleLoader, DinDoor-like JavaScript agents, and now ChainShell as potential indicators of MuddyWater activity, and prioritise investigation when these artifacts appear alongside Farsi-language infrastructure and Israeli-focused targeting sets.
| Indicator | Context |
| 23.94.145.120:9999 | Build 120 C2 |
| 157.20.182.49:8888 | Build 13 C2 + operator infrastructure |
| 172.86.123.222 | Staging (Petuhon.zip, Smokest120.zip) |
| ttrdomennew.com | Build 13 C2 domain |
| serialmenot.com | Gen 1 Deno MaaS C2 (shared multi-tenant — also used by LeakNet) |
| sharecodepro.com | Gen 1 Deno MaaS C2 (Jan 2026, earlier rotation — shared platform) |
| mazafakaerindahouse.info | Dropper staging (no prior public results) |
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…