# Seedworm (MuddyWater) Iranian MOIS APT Campaign Targeting U.S. Critical Infrastructure with Dindoor and Fakeset Backdoors

> Iranian MOIS-affiliated threat group Seedworm (MuddyWater) has been conducting an active cyber espionage campaign against U.S. critical infrastructure since early February 2026, deploying custom backdoors Dindoor (Deno-based) and Fakeset (Python-based) against a U.S. bank, airport, defense/aerospace software supplier with Israeli operations, and multiple nonprofits. The campaign leverages legitimate tools for lateral movement and cloud storage services for data exfiltration.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0176
- **ID:** TL-2026-0176
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-55591, CVE-2025-68613, CVE-2026-1731

## Description

Seedworm, also tracked as MuddyWater, Mango Sandstorm, TEMP.Zagros, and Static Kitten (MITRE G0069), is a subordinate element within Iran's Ministry of Intelligence and Security (MOIS) that has been conducting cyber espionage operations since at least 2017. In early February 2026, Symantec/Broadcom researchers identified active Seedworm intrusions on the networks of multiple U.S. organizations, including a banking institution, an airport, a defense/aerospace software company with Israeli operations, and nonprofit organizations in both the U.S. and Canada.

The campaign employs two previously undocumented backdoors. Dindoor (Trojan.Dindoor) is a novel backdoor that leverages the Deno JavaScript/TypeScript runtime for execution, representing an evolution in the group's tooling toward modern cross-platform runtimes. It was found on the Israeli outpost of a software company, a U.S. bank, and a Canadian nonprofit. Fakeset (Trojan.Fakeset) is a Python-based backdoor discovered on the airport and a U.S. nonprofit's networks. Both malware families were signed with certificates issued to 'Amy Cherne', while Fakeset additionally used a certificate issued to 'Donald Gay' — a signing identity previously linked to Seedworm's Stagecomp downloader and Darkcomp backdoor.

The attack chain begins with spear-phishing emails containing malicious attachments or links, leveraging researched organizational intelligence for social engineering. Upon gaining initial access, the operators deploy Dindoor or Fakeset for persistent remote access. Lateral movement is achieved through RDP, SSH, VNC, and web shells (ReGeorg). The group also deploys legitimate remote access tools including AnyDesk, ScreenConnect, and PDQ to blend with normal administrative traffic.

For data exfiltration, Seedworm uses Rclone to transfer stolen data to Wasabi cloud storage, and downloads additional payloads from Backblaze S3 buckets (gitempire and elvenforest). Stagecomp serves as a downloader for the Darkcomp backdoor, providing an additional persistence and access layer.

The campaign's timing — coinciding with escalating U.S.-Iran geopolitical tensions following coordinated U.S./Israeli military strikes on February 28, 2026 — suggests both intelligence collection and pre-positioning for potential destructive operations. Seedworm has historically conducted wiper attacks (BibiWiper) and has destructive capabilities through Stagecomp and related tooling. The FBI, CISA, and UK NCSC have formally attributed MuddyWater to MOIS operations since 2018.

Defenders should prioritize monitoring for Deno runtime execution in unexpected contexts, Python-based backdoor activity, certificate-signed binaries from unknown issuers (Amy Cherne, Donald Gay), Rclone exfiltration to cloud storage, and connections to the identified C2 domains and Backblaze infrastructure.

---

**Revalidated on 2026-03-12**

Substantial new intelligence has emerged in the week since this threat was published, significantly expanding the understanding of Seedworm/MuddyWater's operational scope and confirming this campaign as part of a strategic Iranian cyber posture preceding and following Operation Epic Fury.

### Ctrl-Alt-Intel VPS Forensics (March 2026)
Forensic analysis of a compromised MuddyWater VPS hosted in the Netherlands revealed three previously undocumented custom C2 frameworks: KeyC2 (Python/UDP on port 1269 with SQLite backend), PersianC2 (HTTP polling with JSON API and AES staging), and ArenaC2 (FastAPI/uvicorn with AES-256-CBC encryption presenting decoy news websites in English, French, and German). The VPS also contained Tsundere botnet infrastructure that leverages Ethereum smart contracts (address 0x2B77671cfEE4907776a95abbb9681eee598c102E) for dynamic C2 resolution via WebSocket connections, demonstrating novel blockchain-based command-and-control. Additional C2 IPs identified include 162.0.230[.]185, 194.11.246[.]101, 185.236.25[.]119, and 193.17.183[.]126. The server contained modified FortiOS exploits (CVE-2024-55591 PoC altered to create persistent 'FortiSetup' admin accounts), evidence of active exploitation of CVE-2026-1731 (BeyondTrust RCE), CVE-2026-1281 (Ivanti EPMM), CVE-2025-68613 (n8n RCE), and reconnaissance tools (Subfinder, Nuclei, Shodan CLI). Targeting extended beyond U.S. infrastructure to Israeli healthcare/immigration organizations, EgyptAir, Jordanian government webmail, UAE energy firms, Portuguese government Exchange servers (compromised with Neo-reGeorg webshells), and U.S. company Clearview AI. Exfiltrated data included Egyptian passport/visa information, King Khalid Airport receipts, WhatsApp data, and biometric access control configurations.

### Check Point Research: MOIS-Cybercrime Nexus (March 10, 2026)
Check Point Research identified Dindoor as a variant of the 'Tsundere' botnet family, establishing a direct technical lineage. More significantly, the report documented MOIS actors' strategic pivot to leveraging commercial cybercriminal infrastructure for plausible deniability: shared code-signing certificates ('Amy Cherne'/'Donald Gay') link MuddyWater's custom tooling to CastleLoader malware-as-a-service operations; the October 2025 Shamir Medical Center attack was attributed to Iranian operators using Qilin ransomware-as-a-service; and Handala persona deployed Rhadamanthys commercial infostealer alongside custom wipers against Israeli targets.

### Operation Olalampo: Concurrent MENA Campaign (January 26, 2026)
Group-IB documented a concurrent MuddyWater campaign (Operation Olalampo) targeting MENA organizations via phishing with malicious Office macros, deploying multiple novel payloads: CHAR (a Rust backdoor using Telegram bot 'stager_51_bot' for C2, with evidence of AI-assisted development via emoji debug strings), GhostFetch and HTTP_VIP (downloaders), and GhostBackDoor (advanced implant). This campaign ran in parallel with the U.S. infrastructure intrusions, demonstrating MuddyWater's capacity for simultaneous multi-theater operations.

### Broader MOIS Ecosystem Escalation
The Handala/Void Manticore wiper attack on Stryker Corporation (March 11, 2026) claiming 200,000 systems destroyed via Microsoft Intune remote wipe, combined with IP camera exploitation surges across Israel and Gulf states (CVE-2017-7921, CVE-2021-33044, CVE-2021-36260), demonstrates that MuddyWater's espionage operations are one component of a coordinated multi-actor MOIS cyber offensive. CISA, FBI, DC3, and NSA issued a joint statement warning of potential targeted Iranian cyber activity against U.S. critical infrastructure, urging heightened vigilance for defense industrial base organizations with Israeli ties.

### New CVEs Under Active Exploitation
CVE-2026-1731 (BeyondTrust RCE), CVE-2026-1281 (Ivanti EPMM code injection), CVE-2025-68613 (n8n RCE), CVE-2025-52691 (SmarterMail file upload), CVE-2025-9316 (N-Central improper access control), CVE-2024-55591 (FortiOS authentication bypass), CVE-2024-23113 (FortiOS format string), CVE-2022-42475 (FortiOS heap overflow).

## MITRE ATT&CK

- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1187 Forced Authentication
- T1087 Account Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1074 Data Staged
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1561 Disk Wipe
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1598 Phishing for Information

## Sources

- [Seedworm: Iranian APT on Networks of U.S. Bank, Airport, Software Company](https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us)
- [Iran intelligence backdoored US bank, airport networks](https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/)
- [MuddyWater Targets Orgs With Fresh Malware Amid Rising Tensions](https://www.darkreading.com/threat-intelligence/iran-muddywater-new-malware-tensions-mount)
- [MITRE ATT&CK - MuddyWater (G0069)](https://attack.mitre.org/groups/G0069/)
- [CISA Advisory AA22-055A: Iranian Government-Sponsored Actors Conduct Cyber Operations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a)
- [RustyWater: MuddyWater APT Targets Israeli Infrastructure](https://www.rescana.com/post/rustywater-iranian-muddywater-apt-targets-israeli-government-and-infrastructure-with-advanced-rust)
- [MuddyWater APT Profile: Tactics, Malware, And MITRE ATT&CK](https://cyble.com/threat-actor-profiles/muddywater-apt/)
- [MuddyWater: Operation Olalampo](https://secpro.substack.com/p/muddywater-operation-olalampo)
- [Unmasking MuddyWater New Malware Toolkit](https://www.group-ib.com/blog/muddywater-espionage/)
- [MuddyWater Threat Actor Profile - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/actor/muddywater)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0176