# Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and SentinelOne Binaries, ChromElevator Browser Theft, Node.js/PowerShell Implant Chain

> Iran-linked Seedworm (MuddyWater / Static Kitten / Temp Zagros — widely attributed to Iran's Ministry of Intelligence and Security, MOIS) ran a Q1 2026 espionage campaign hitting at least nine organizations across nine countries on four continents, including a week-long intrusion (February 20–27, 2026) into a major South Korean electronics manufacturer. The operators paired legitimately signed third-party executables (Fortemedia fmapp.exe and SentinelOne sentinelmemoryscanner.exe) with malicious DLLs (fmapp.dll, sentinelagentcore.dll) to sideload ChromElevator, a public Chromium credential/cookie/payment-card stealer, while a Node.js-based loader chain orchestrated PowerShell stages for reconnaissance, screenshot capture, SAM hive theft, Kerberos TGT-extraction-driven privilege escalation, and SOCKS5 reverse-proxy tunnelling. Data was exfiltrated through public consumer file-transfer service sendit.sh.

- **Published:** 2026-05-12T12:00:00Z
- **Last reviewed:** 2026-05-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0500
- **ID:** TL-2026-0500
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 49 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Symantec's Threat Hunter Team disclosed on 12 May 2026 a multi-victim Seedworm (a.k.a. MuddyWater, Static Kitten, Temp Zagros) espionage campaign observed in the first quarter of 2026, spanning at least nine victim organizations across nine countries on four continents. Confirmed victim profiles include a major South Korean electronics manufacturer (week-long intrusion, 20–27 February 2026), Middle East government agencies, a Middle East international airport, Southeast Asian industrial manufacturers, a Latin American financial-services provider, and educational institutions in multiple countries. The campaign is consistent with MOIS-aligned strategic intelligence collection focused on high-tech manufacturing intellectual property, rival-government intelligence, and downstream service-provider access.

The defining tradecraft of this wave is DLL sideloading abuse of two legitimately signed, third-party Windows executables. The first pair — Fortemedia Inc.'s signed audio driver utility fmapp.exe paired with a malicious fmapp.dll — has prior reporting in Group-IB's MuddyWater telemetry. The second pair is notably new and provocative: SentinelOne's signed sentinelmemoryscanner.exe, a legitimate component of the SentinelOne endpoint product, was abused to sideload a malicious sentinelagentcore.dll. The operators' deliberate choice of a security-product binary is designed to defeat path- and signature-based detection, exhaust triage-analyst attention through false 'security product activity' attribution, and complicate evidence collection on managed endpoints. Both malicious DLLs delivered ChromElevator, a publicly available post-exploitation tool that covertly extracts and exfiltrates passwords, cookies, and payment-card data from Chromium-based browsers (Chrome, Edge, Brave, Opera, etc.).

In every observed instance the sideloaded executables ran under node.exe (the Node.js runtime) as parent or grandparent process, indicating that a Node.js loader script (a previously unattested tactical shift from the group's earlier reliance on the Deno runtime) drove execution rather than a human operator. A Node.js script was recovered embedded inside an XML file on the victim host. From that loader, the operators issued PowerShell stages downloaded from a hard-coded plaintext-HTTP staging server at 179.43.177[.]220:8080 and from a fallback attacker-owned domain timetrakr[.]cloud. Files observed being fetched include nm.ps1, a.dat (suspected encoded payload), a.exe (suspected Windows binary), sp.ps1 (screenshot capture), and lpu.dll (a PowerShell module despite the .dll extension). curl.exe was used for several downloads to keep network artefacts out of PowerShell's script-block logs.

The Korean intrusion timeline began on 20 February 2026 with a tight burst of PowerShell reconnaissance (whoami, whoami /all, hostname, ipconfig /all, net session, net user /domain, net group <REMOVED> /domain) followed by a WMI antivirus enumeration (wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get *), automated screenshot capture, ipinfo.io/json public-IP discovery, the first DLL sideload pair (fmapp.exe + fmapp.dll), then a second pair (sentinelmemoryscanner.exe + sentinelagentcore.dll) approximately fifteen minutes later. Persistence was installed via an HKCU\Software\Microsoft\Windows\CurrentVersion\Run value with a randomly generated name pointing at the sideloaded binary. Credential dumping proceeded through SAM/SECURITY/SYSTEM hive theft (reg save hklm\sam | security | system to C:\Windows\Temp), execution of a privilege-escalation binary (SHA256 74ab3838... — automated Kerberos TGT extraction via GSS-API delegation abuse to obtain a usable ticket from a high-privilege account without password knowledge), and two further credential stealers, including a credential harvester (d587959841... ) that calls CredUIPromptForWindowsCredentialsW to spoof a Windows credential dialog and persists captured passwords to C:\ProgramData\lopa.txt. Implant beaconing produced near-identical short PowerShell reconnaissance commands every ~90 seconds for hour-long runs separated by quiet windows — consistent with timer-driven implant activity rather than hands-on-keyboard operations. On 22 February the operators re-staged sp.ps1 and lpu.dll from timetrakr[.]cloud, performed deeper scheduled-task and service enumeration, then exfiltrated tranches of staged data from C:\Windows\Temp via curl.exe HTTP POSTs to https://sendit.sh — a public consumer file-transfer service that, while marketed as legitimate, has prior VirusTotal records of malicious abuse. Activity continued intermittently through 26–27 February before tapering off.

Additional tooling on victim hosts included a standalone SOCKS5 proxy tool (b21c802775...) providing the operators a tunnel through which to relay traffic, and two distinct SAM hive credential extractors (3ee7dab4..., bee79c33...). The number and redundancy of credential-theft tooling deployed onto a single host in a short window is itself a TTP signature: operators expect endpoint security products to block at least one binary and rotate through alternatives until one succeeds.

Strategically, this campaign represents a measurable maturation of Seedworm tradecraft over the prior two to three years: orchestration migrated from raw PowerShell to Node.js loaders embedded in benign-extension files; DLL sideloading uses legitimate signed binaries including a security-product component; exfiltration runs through public consumer cloud services to blend with legitimate traffic; credential-theft tooling is layered for redundancy; and target geography has expanded well beyond the group's traditional Middle East / South Asia hunting ground into East Asia, Southeast Asia, and Latin America. None of these techniques is individually novel, but their combination evidences a deliberate step up in operational hygiene by an Iranian state-aligned actor under apparent pressure to deliver collection volume against a backdrop of continued nuclear-program tension and regional conflict.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1583.001 Acquire Infrastructure: Domains
- T1583.004 Acquire Infrastructure: Server
- T1588.002 Tool
- T1588.003 Code Signing Certificates
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.007 JavaScript
- T1204.002 User Execution: Malicious File
- T1047 Windows Management Instrumentation
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1550.003 Pass the Ticket
- T1036.005 Match Legitimate Resource Name or Location
- T1218 System Binary Proxy Execution
- T1553.002 Code Signing
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1003.002 Security Account Manager
- T1003.004 LSA Secrets
- T1003.005 OS Credential Dumping: Cached Domain Credentials
- T1555.003 Credentials from Web Browsers
- T1056.002 GUI Input Capture
- T1558 Steal or Forge Kerberos Tickets
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1049 System Network Connections Discovery
- T1087.002 Domain Account
- T1069.002 Domain Groups
- T1069.001 Local Groups
- T1518.001 Security Software Discovery
- T1007 System Service Discovery
- T1053 Scheduled Task/Job
- T1021 Remote Services
- T1113 Screen Capture

## Sources

- [Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign](https://www.security.com/threat-intelligence/iran-seedworm-electronics)
- [Symantec Protection Bulletin (latest)](https://www.broadcom.com/support/security-center/protection-bulletin)
- [Group-IB MuddyWater February 2026 Report (referenced by Symantec article)](https://www.group-ib.com/blog/muddywater/)
- [MITRE ATT&CK Group G0069 — MuddyWater](https://attack.mitre.org/groups/G0069/)
- [MITRE ATT&CK T1574.002 — DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK T1003.002 — SAM Hive Credential Dumping](https://attack.mitre.org/techniques/T1003/002/)
- [MITRE ATT&CK T1567 — Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567/)
- [MITRE ATT&CK T1555.003 — Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003/)
- [ChromElevator (public Chromium post-exploitation credential/cookie stealer)](https://github.com/search?q=ChromElevator)
- [ipinfo.io public IP API (used by Seedworm for environment recon)](https://ipinfo.io/json)
- [sendit.sh public file-transfer service (abused for exfiltration)](https://sendit.sh/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0500