Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and SentinelOne Binaries, ChromElevator Browser Theft, Node.js/PowerShell Implant Chain
Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign (TL-2026-0500), also tracked as Seedworm Q1 2026 Korean Electronics Campaign, is a high-severity advanced persistent threat campaign, first published 2026-05-12. It is attributed to MuddyWater (Iran) with high confidence, affects Fortemedia Inc. fmapp.exe (audio driver utility), maps to 51 MITRE ATT&CK techniques (T1003.002, T1003.004, T1003.005), and is covered by 9 detection rules and 49 indicators of compromise.
Key facts for TL-2026-0500
- Threat ID
- TL-2026-0500
- Also known as
- Seedworm Q1 2026 Korean Electronics Campaign, MuddyWater 2026 Global Espionage Wave, Seedworm sentinelmemoryscanner.exe DLL Sideloading Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-05-12
- Last reviewed
- 2026-05-12
- Attribution
- MuddyWater
- Attribution confidence
- HIGH
- Nation-state nexus
- Iran
- Motivation
- ESPIONAGE
- Target sectors
- industrial manufacturing, electronics manufacturing, education, public sector, government agencies, financial services, professional services, transportation (aviation)
- Target regions
- East Asia, South Korea, Southeast Asia, Middle East, Latin America, Europe, North America
- Detection rules
- 9
- Indicators of compromise
- 49
Malware and tooling in Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign
Malware and tooling: ChromElevator, ChromElevator, Custom Node.js + PowerShell implant chain (no Cobalt Strike / Sliver / Brute Ratel observed), Node.js (node.exe) embedded XML loader
Iran-linked Seedworm (MuddyWater / Static Kitten / Temp Zagros — widely attributed to Iran's Ministry of Intelligence and Security, MOIS) ran a Q1 2026 espionage campaign hitting at least nine organizations across nine countries on four continents, including a week-long intrusion (February 20–27, 2026) into a major South Korean electronics manufacturer. The operators paired legitimately signed third-party executables (Fortemedia fmapp.exe and SentinelOne sentinelmemoryscanner.exe) with malicious DLLs (fmapp.dll, sentinelagentcore.dll) to sideload ChromElevator, a public Chromium credential/cookie/payment-card stealer, while a Node.js-based loader chain orchestrated PowerShell stages for reconnaissance, screenshot capture, SAM hive theft, Kerberos TGT-extraction-driven privilege escalation, and SOCKS5 reverse-proxy tunnelling. Data was exfiltrated through public consumer file-transfer service sendit.sh.
How Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign works
Symantec's Threat Hunter Team disclosed on 12 May 2026 a multi-victim Seedworm (a.k.a. MuddyWater, Static Kitten, Temp Zagros) espionage campaign observed in the first quarter of 2026, spanning at least nine victim organizations across nine countries on four continents. Confirmed victim profiles include a major South Korean electronics manufacturer (week-long intrusion, 20–27 February 2026), Middle East government agencies, a Middle East international airport, Southeast Asian industrial manufacturers, a Latin American financial-services provider, and educational institutions in multiple countries. The campaign is consistent with MOIS-aligned strategic intelligence collection focused on high-tech manufacturing intellectual property, rival-government intelligence, and downstream service-provider access.
The defining tradecraft of this wave is DLL sideloading abuse of two legitimately signed, third-party Windows executables. The first pair — Fortemedia Inc.'s signed audio driver utility fmapp.exe paired with a malicious fmapp.dll — has prior reporting in Group-IB's MuddyWater telemetry. The second pair is notably new and provocative: SentinelOne's signed sentinelmemoryscanner.exe, a legitimate component of the SentinelOne endpoint product, was abused to sideload a malicious sentinelagentcore.dll. The operators' deliberate choice of a security-product binary is designed to defeat path- and signature-based detection, exhaust triage-analyst attention through false 'security product activity' attribution, and complicate evidence collection on managed endpoints. Both malicious DLLs delivered ChromElevator, a publicly available post-exploitation tool that covertly extracts and exfiltrates passwords, cookies, and payment-card data from Chromium-based browsers (Chrome, Edge, Brave, Opera, etc.).
In every observed instance the sideloaded executables ran under node.exe (the Node.js runtime) as parent or grandparent process, indicating that a Node.js loader script (a previously unattested tactical shift from the group's earlier reliance on the Deno runtime) drove execution rather than a human operator. A Node.js script was recovered embedded inside an XML file on the victim host. From that loader, the operators issued PowerShell stages downloaded from a hard-coded plaintext-HTTP staging server at 179.43.177[.]220:8080 and from a fallback attacker-owned domain timetrakr[.]cloud. Files observed being fetched include nm.ps1, a.dat (suspected encoded payload), a.exe (suspected Windows binary), sp.ps1 (screenshot capture), and lpu.dll (a PowerShell module despite the .dll extension). curl.exe was used for several downloads to keep network artefacts out of PowerShell's script-block logs.
The Korean intrusion timeline began on 20 February 2026 with a tight burst of PowerShell reconnaissance (whoami, whoami /all, hostname, ipconfig /all, net session, net user /domain, net group <REMOVED> /domain) followed by a WMI antivirus enumeration (wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get *), automated screenshot capture, ipinfo.io/json public-IP discovery, the first DLL sideload pair (fmapp.exe + fmapp.dll), then a second pair (sentinelmemoryscanner.exe + sentinelagentcore.dll) approximately fifteen minutes later. Persistence was installed via an HKCU\Software\Microsoft\Windows\CurrentVersion\Run value with a randomly generated name pointing at the sideloaded binary. Credential dumping proceeded through SAM/SECURITY/SYSTEM hive theft (reg save hklm\sam | security | system to C:\Windows\Temp), execution of a privilege-escalation binary (SHA256 74ab3838... — automated Kerberos TGT extraction via GSS-API delegation abuse to obtain a usable ticket from a high-privilege account without password knowledge), and two further credential stealers, including a credential harvester (d587959841... ) that calls CredUIPromptForWindowsCredentialsW to spoof a Windows credential dialog and persists captured passwords to C:\ProgramData\lopa.txt. Implant beaconing produced near-identical short PowerShell reconnaissance commands every ~90 seconds for hour-long runs separated by quiet windows — consistent with timer-driven implant activity rather than hands-on-keyboard operations. On 22 February the operators re-staged sp.ps1 and lpu.dll from timetrakr[.]cloud, performed deeper scheduled-task and service enumeration, then exfiltrated tranches of staged data from C:\Windows\Temp via curl.exe HTTP POSTs to https://sendit.sh — a public consumer file-transfer service that, while marketed as legitimate, has prior VirusTotal records of malicious abuse. Activity continued intermittently through 26–27 February before tapering off.
Additional tooling on victim hosts included a standalone SOCKS5 proxy tool (b21c802775...) providing the operators a tunnel through which to relay traffic, and two distinct SAM hive credential extractors (3ee7dab4..., bee79c33...). The number and redundancy of credential-theft tooling deployed onto a single host in a short window is itself a TTP signature: operators expect endpoint security products to block at least one binary and rotate through alternatives until one succeeds.
Strategically, this campaign represents a measurable maturation of Seedworm tradecraft over the prior two to three years: orchestration migrated from raw PowerShell to Node.js loaders embedded in benign-extension files; DLL sideloading uses legitimate signed binaries including a security-product component; exfiltration runs through public consumer cloud services to blend with legitimate traffic; credential-theft tooling is layered for redundancy; and target geography has expanded well beyond the group's traditional Middle East / South Asia hunting ground into East Asia, Southeast Asia, and Latin America. None of these techniques is individually novel, but their combination evidences a deliberate step up in operational hygiene by an Iranian state-aligned actor under apparent pressure to deliver collection volume against a backdrop of continued nuclear-program tension and regional conflict.
MITRE ATT&CK techniques used in TL-2026-0500
Credential Access
T1003.002 Security Account Manager; T1003.004 LSA Secrets; T1003.005 OS Credential Dumping: Cached Domain Credentials; T1056.002 GUI Input Capture; T1555.003 Credentials from Web Browsers; T1558 Steal or Forge Kerberos Tickets
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1113 Screen Capture
Discovery
T1007 System Service Discovery; T1016 System Network Configuration Discovery; T1016.001 Internet Connection Discovery; T1033 System Owner/User Discovery; T1049 System Network Connections Discovery; T1069.001 Local Groups; T1069.002 Domain Groups; T1082 System Information Discovery; T1087.002 Domain Account; T1518.001 Security Software Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution
Execution
T1047 Windows Management Instrumentation; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.007 JavaScript; T1204.002 User Execution: Malicious File
Exfiltration
T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol; T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage
execution
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Initial Access
T1190 Exploit Public-Facing Application; T1566 Phishing
Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
lateral-movement
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
Impact
stealth
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.004 Acquire Infrastructure: Server; T1588.002 Tool; T1588.003 Code Signing Certificates
Reconnaissance
Affected products and versions in Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign
- Fortemedia Inc. — fmapp.exe (audio driver utility)
- SentinelOne — sentinelmemoryscanner.exe (endpoint product component)
- Microsoft — Windows (Chromium-based browser ecosystems)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2016/2019/2022/2025 - Google / Microsoft / Brave / Opera — Chromium-based browsers (Chrome, Edge, Brave, Opera)
Remediation for Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign
Patches
- No vendor patch applies; this is APT campaign activity, not a software vulnerability.
Immediate actions
- Block staging IP 179.43.177.220 inbound and outbound at perimeter and EDR network controls; alert on any plaintext HTTP to port 8080 originating from user workstations.
- Block attacker-owned staging domain timetrakr.cloud and the public file-transfer service sendit.sh (and svc.wompworthy.com) at egress proxy and DNS firewall layers.
- Hunt and block all nine campaign SHA256 hashes (fmapp.exe, fmapp.dll, sentinelmemoryscanner.exe, sentinelagentcore.dll, privilege-escalation tool, two SAM hive extractors, credential harvester, SOCKS5 proxy) on endpoints and email gateways.
- Hunt for node.exe parent/grandparent relationships with cmd.exe, powershell.exe, fmapp.exe, or sentinelmemoryscanner.exe across the estate.
- Hunt for HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries pointing at user-profile-local copies of fmapp.exe or sentinelmemoryscanner.exe.
- Hunt for the credential-harvester artefact C:\ProgramData\lopa.txt and for reg save outputs sam.save, security.save, system.save under C:\Windows\Temp.
- Hunt for outbound curl.exe HTTP POSTs to sendit.sh and for PowerShell DownloadString cradles referencing 179.43.177.220 or timetrakr.cloud.
Workarounds
- Where possible, remove or quarantine legacy Fortemedia audio-driver utilities (fmapp.exe) from user workstations until enterprise-controlled deployment is required.
- Validate that SentinelOne deployment uses managed installer locations and that sentinelmemoryscanner.exe is not present in non-managed paths (e.g., user-profile AppData directories); alert on any out-of-path copies.
- Deny outbound HTTP on non-standard ports (8080 in particular) from end-user workstations at the perimeter.
- Block first-stage download cradles using HTTPS inspection and SSL decryption combined with PowerShell IEX cradle detection signatures.
Longer-term hardening
- Deploy EDR with behavioural detection capable of identifying DLL sideloading via DLL search-order hijacks (correlate signed-binary execution from non-standard paths with co-located unsigned DLL loads).
- Enable PowerShell script-block logging, module logging, and transcript logging across the estate; forward to a SIEM with detection rules for IEX DownloadString cradles, Invoke-WebRequest reconnaissance to ipinfo.io, and reg save against SAM/SECURITY/SYSTEM.
- Restrict execution of Node.js (node.exe) on user workstations via application-control policies (WDAC, AppLocker, or equivalent); where Node.js is required, restrict by path and signer.
- Implement DNS egress filtering with category-based blocking of consumer file-transfer / paste services (sendit.sh, file.io, transfer.sh, etc.) for non-development users.
- Deploy Credential Guard and LSA protection (RunAsPPL) to mitigate hive-theft and LSASS access; ensure SAM/SECURITY/SYSTEM hives are protected by Volume Shadow Copy permissions.
- Audit Active Directory for GSS-API delegation paths; enforce 'Account is sensitive and cannot be delegated' on privileged accounts; deploy gMSA and minimise unconstrained delegation.
- Enable browser-stored-credential encryption keys protected by application-bound encryption (Chrome App-Bound Encryption / Edge App-Bound Encryption) to mitigate ChromElevator-class theft.
Weaknesses (CWE) in Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign
CWE-426, CWE-427, CWE-829, CWE-732
Timeline of Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign
- SAM/SECURITY/SYSTEM hive theft via reg save hklm\sam | security | system to C:\Windows\Temp\*.save. Privilege-escalation binary (Kerberos TGT extraction via GSS-API delegation abuse) executed. Two further credential stealers run within 30 minutes including credential harvester d587959841... spoofing Windows credential dialog and writing to C:\ProgramData\lopa.txt.
- ~15 minutes later, second DLL sideloading pair executed: sentinelmemoryscanner.exe (legitimate signed SentinelOne endpoint product component) sideloaded malicious sentinelagentcore.dll containing ChromElevator. node.exe again grandparent. Persistence installed via HKCU\...\CurrentVersion\Run pointing at sideloaded binary in user profile.
- First DLL sideloading pair deployed: fmapp.exe (legitimate signed Fortemedia audio-driver utility) launched and immediately loaded malicious fmapp.dll from the same directory; node.exe observed as grandparent process.
- First download cradle fired: powershell IEX DownloadString to http://179.43.177[.]220:8080/nm.ps1 (plaintext HTTP on TCP/8080). Two further files (a.dat, a.exe) fetched via curl.exe over the next ~2 hours into a random-named per-user AppData directory.
- Approximately 12 minutes after initial recon, a PowerShell one-liner captured a screenshot of the user's primary display and wrote it to disk under the user profile.
- First malicious activity on Korean electronics manufacturer host: short burst of PowerShell reconnaissance commands executed under a node.exe ancestor process (whoami, whoami /all, hostname, ipconfig /all, net session, net user /domain, net group <REMOVED> /domain) followed by WMI antivirus enumeration via SecurityCenter2.
- Implant produced steady cadence of identical short PowerShell reconnaissance / ping-style commands every ~90 seconds for hour-long runs separated by hours of silence — consistent with timer-driven beaconing rather than hands-on-keyboard activity.
- More aggressive host and domain reconnaissance (schtasks, services, repeated net group / net localgroup with different group names), followed by data exfiltration from C:\Windows\Temp via curl.exe HTTP POSTs to https://sendit.sh public file-transfer service.
- Operators returned, re-checked public IP via ipinfo.io/json, then pulled sp.ps1 (screenshot capture) and lpu.dll (PowerShell module despite extension) from fallback attacker-owned staging domain https://timetrakr[.]cloud, providing second independent fetch channel.
- Activity on Feb 23–24 consisted of short PowerShell reconnaissance, periodic public-IP checks, and occasional re-executions of fmapp.exe and sentinelmemoryscanner.exe to maintain live SOCKS5 tunnel and keep sideloaded DLLs resident in memory.
- After ~36 hours of silence, activity resumed with final round of credential dumping, re-staging of fresh tooling into a newly created random-named directory, and net group / net localgroup queries against a different set of group names — searching for a path into a more privileged domain group.
- Final observed activity: sideloaded fmapp.exe re-launched. End of week-long dwell on the Korean electronics manufacturer host.
- Symantec published 9 file-hash IOCs (Fortemedia / SentinelOne sideload pairs, two SAM hive extractors, privilege-escalation tool, credential harvester, SOCKS5 proxy) and 8 network IOCs (179.43.177.220, 178.128.233.36, 172.67.156.47, 104.21.48.205, 37.187.78.41, 34.117.59.81, timetrakr.cloud, sendit.sh) for defender consumption.
- Symantec Threat Hunter Team (Broadcom) publicly disclosed the campaign on security.com, attributing it to Seedworm / MuddyWater with HIGH confidence based on tooling overlap (fmapp pair, ChromElevator, Node.js loader shift from Deno) with prior Group-IB MuddyWater reporting.
- As of 2026-05-29, this Iran/MOIS Seedworm (MuddyWater) campaign remains active: no patch applies (TTP/trust-abuse, no CVE), no takedown or arrests reported, and the actor is escalating across 2026 with parallel Dindoor/Fakeset waves vs US/Canada and a Chaos-ransomware false-flag op. Tradecraft (signed-binary DLL sideloading, ChromElevator) stays fully viable.
Sources cited for Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign
- Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign
- Symantec Protection Bulletin (latest)
- Group-IB MuddyWater February 2026 Report (referenced by Symantec article)
- MITRE ATT&CK Group G0069 — MuddyWater
- MITRE ATT&CK T1574.002 — DLL Side-Loading
- MITRE ATT&CK T1003.002 — SAM Hive Credential Dumping
- MITRE ATT&CK T1567 — Exfiltration Over Web Service
- MITRE ATT&CK T1555.003 — Credentials from Web Browsers
- ChromElevator (public Chromium post-exploitation credential/cookie stealer)
- ipinfo.io public IP API (used by Seedworm for environment recon)
- sendit.sh public file-transfer service (abused for exfiltration)
Threats related to Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign
Detection coverage for TL-2026-0500
As of 2026-05-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0500 across Splunk SPL, Microsoft KQL and Sigma, covering 49 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.