A DNS Exploration of Operation Olalampo

MuddyWater has long been active in state-sponsored cyber operations. In its latest campaign, dubbed “Operation Olalampo,” the group targeted organizations and individuals primarily across the MENA region, leveraging geopolitical tensions. The attackers deployed new malware variants and used Telegram bots for command-and-control (C&C).

Group-IB identified¹ seven network IoCs associated with the activity. We analyzed all seven IoCs, comprising four domains and three IP addresses, and confirmed that none were tied to legitimate ownership. Using our homegrown tools to investigate the threat, we uncovered these findings:

• 10 unique potential victim IP addresses communicated with one of the IP addresses identified as IoCs
• 2,530 email-connected domains
• Six additional IP addresses, all of which turned out to be malicious
• 55 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.group-ib.com/blog/muddywater-operation-olalampo/