Skip to content

RustyWater

Software · ATTACK:enterprise:S9037

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S9037",
  "title": "RustyWater",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S9037",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--50be4e81-db74-41a2-a9aa-423314082bea",
  "external_id": "S9037",
  "domain": "enterprise",
  "created": "2026-04-21T15:00:10.376Z",
  "modified": "2026-05-12T15:12:00.733Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Archer RAT / RUSTRIC"
    },
    {
      "source_name": "CloudSEK_RustyWater_Jan2026",
      "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
    }
  ]
}

Explicit source assertions (21)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1684.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09bef668-b821-4228-adb3-35a4605ac3e9

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0daaaf08-6db8-4b57-8ba7-ff1cc32127b3

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11d7c83e-7b34-447a-9775-fb9c373bdfcd

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2854c1cb-d7e6-484a-afff-4a1e3a43df64

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34e457ce-e0c4-4e74-af74-6c27db10b422

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a9d2be9-57a6-49d6-9301-253351927e82

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b9a3c69-a667-4bba-b920-ee04e729800b

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d32732f-e0ca-4ec7-833a-2eae547c2c44

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4114a4a5-c9e7-4f61-90f3-4a13789a6b37

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d580ddf-51b4-4849-b54f-a6fed828ba86

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--600e55f7-1a72-4289-9c4c-b66798a58776

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1678

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--681e2011-de1d-45ab-8168-329a3095338f

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ac91e9e-447c-4def-9f4a-9c29c355c832

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e44c694-2fc7-4ebd-8e18-7562dce4d60e

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1622

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a64c7c7d-f08c-40a3-802b-e25fe9eaea6c

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a824dc85-8e56-4394-aa36-e466bbc2cf55

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1559.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6ab77f2-e201-4184-b093-d6f54ada594b

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2e3c3ad-669a-4c20-8fd8-04626433a03c

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:S9037

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd19c1ef-38fc-45d7-ba6c-60773fce7890

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de6a4e97-7142-41d8-9830-2146ebef9db7

CloudSEK_RustyWater_Jan2026

ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e10a3f38-fe4b-4bf3-9d36-cdf18854ed2a

CloudSEK_RustyWater_Jan2026

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.