# Iranian State-Aligned Global Cyber Operations Surge Amid Iran Conflict (MuddyWater/Seedworm Dindoor & Fakeset Campaign)

> A sustained, measurable elevation in global cyber risk driven by Iranian state-aligned operations amid the 2026 Iran conflict. The MOIS-linked MuddyWater (Seedworm) APT expanded Western targeting in Feb-Mar 2026, backdooring a U.S. bank, a U.S. airport, and a U.S. defense/aerospace software supplier with the new Deno-based Dindoor backdoor and the Python-based Fakeset implant, blending espionage, disruption, and criminal tradecraft.

- **Published:** 2026-03-17T00:00:00Z
- **Last reviewed:** 2026-10-16T02:09:45.827Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0748
- **ID:** TL-2026-0748
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 44 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Avertium's Cyber Threat Assessment, corroborated by Microsoft, Google Threat Intelligence Group (GTIG), Palo Alto Unit 42, SentinelOne, Recorded Future Insikt Group, Check Point, Broadcom/Symantec, and CISA, reports a coordinated, multi-track Iranian state-aligned cyber campaign running in parallel with the kinetic escalation of the Iran conflict that intensified in late February 2026. The campaign is characterized by faster operational tempo, blended tradecraft (espionage + disruption + criminal proxies), and an increased willingness to accept operational risk, with expanded direct and indirect targeting of the U.S. and allied entities.

The central observed operator is MuddyWater (a.k.a. Seedworm, Mango Sandstorm, Static Kitten, TEMP.Zagros, Earth Vetala, TA450, MERCURY; MITRE G0069), assessed as a subordinate element of Iran's Ministry of Intelligence and Security (MOIS), active since at least 2017. In February 2026, Symantec's Threat Hunter Team observed MuddyWater compromising a U.S. bank, a U.S. airport, a Canadian non-profit, a U.S. non-profit, and the Israeli operations of a U.S. software company that supplies the defense and aerospace sectors. The intrusions deployed two new implants: Dindoor, a previously undocumented backdoor that abuses the Deno secure JavaScript/TypeScript runtime for execution and was signed with a code-signing certificate issued to 'Amy Cherne'; and Fakeset, a Python backdoor staged from Backblaze B2 cloud storage buckets and signed with certificates issued to 'Amy Cherne' and 'Donald Gay'. The 'Donald Gay' certificate had previously signed the Stagecomp and Darkcomp malware families attributed to Seedworm, providing the attribution linkage. Rclone was used to copy collected/backup data to Wasabi cloud storage for exfiltration.

The group's tradecraft remains heavily PowerShell- and LOLBin-centric (mshta.exe, regsvr32.exe, rundll32.exe, certutil.exe), pairing macro-enabled spear-phishing documents and exposed/unpatched edge-device exploitation for initial access with registry Run-key persistence, credential and browser-data theft, software/security-tool discovery, lateral movement, and encrypted HTTP/S C2 over standard and non-standard ports. Across 2025-2026 MuddyWater progressively shed commodity RMM reliance in favor of purpose-built malware (BugSleep, StealthCache, Phoenix, the Fooder loader, MuddyViper) and advanced to Rust-based payloads (RustyWater, CHAR) that use asynchronous JSON/base64/XOR-encrypted C2, process injection, layered encryption, randomized sleep/jitter, and 20+ security-product checks. Reporting also notes commercial satellite internet (Starlink) and legitimate cloud/CDN/messaging infrastructure abuse for low-signal C2. GTIG separately documents Iranian APT use of generative AI for reconnaissance, phishing-lure creation, and malware development, raising scale and quality of operations.

The assessment warns of elevated probability of destructive wiper activity and critical-infrastructure attacks if tensions escalate further, and recommends defenders treat this as a sustained threat period rather than a one-off alert, prioritizing behavioral detection over signature reliance.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1137 Office Application Startup
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1218 System Binary Proxy Execution
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1518 Software Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1219 Remote Access Tools
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1105 Ingress Tool Transfer

## Sources

- [CTA Campaign Assessment: The Iran Conflict - Global Cyber Operations Risk](https://www.avertium.com/resources/threat-reports/cta-campaign-assessment-the-iran-conflict-global-cyber-operations-risk)
- [Seedworm: Iranian APT on Networks of U.S. Bank, Airport, Software Company](https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us)
- [Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html)
- [Iran intelligence backdoored US bank, airport networks (The Register)](https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/)
- [Iran-linked APT targets US critical sectors with new backdoors (Help Net Security)](https://www.helpnetsecurity.com/2026/03/06/seedworm-muddywater-backdoors-victims/)
- [Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations (Security Affairs)](https://securityaffairs.com/189060/apt/iran-linked-muddywater-deploys-dindoor-malware-against-u-s-organizations.html)
- [RustyWater: Iranian MuddyWater APT Targets Israeli Government and Infrastructure With Advanced Rust-Based Malware](https://www.rescana.com/post/rustywater-iranian-muddywater-apt-targets-israeli-government-and-infrastructure-with-advanced-rust)
- [MuddyWater, Seedworm, Mango Sandstorm (Group G0069) - MITRE ATT&CK](https://attack.mitre.org/groups/G0069/)
- [The Iranian Cyber Capability 2026 (Trellix)](https://www.trellix.com/blogs/research/the-iranian-cyber-capability-2026/)
- [Iranian Phishing Campaign Targets Organizational Email (Israel National Cyber Directorate)](https://www.gov.il/en/pages/muddywater041225)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0748