# Seedworm (MuddyWater) Iranian MOIS APT Deploys Dindoor and Fakeset Backdoors Against U.S. Bank, Airport, and Defense Software Company

> Seedworm (MuddyWater), a subordinate element of Iran's Ministry of Intelligence and Security (MOIS), compromised the networks of a U.S. bank, a U.S. airport, a U.S. defense/aerospace software supplier, and U.S./Canadian non-profits beginning early February 2026, amid escalation following U.S./Israeli military strikes on Iran. The campaign introduced two previously unknown backdoors — the Deno-runtime JavaScript implant Dindoor and the Python implant Fakeset — both signed with code-signing certificates ('Amy Cherne' and 'Donald Gay') reused from prior Seedworm Stagecomp/Darkcomp operations, with malware staged on Backblaze B2 and data exfiltrated via Rclone to Wasabi cloud storage.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0757
- **ID:** TL-2026-0757
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-6895, CVE-2017-7921

## Description

In a report published March 5, 2026, Symantec's Threat Hunter Team (Security.com) documented an active in-the-wild intrusion campaign by the Iranian state-sponsored APT group Seedworm — widely tracked as MuddyWater, Temp Zagros, and Static Kitten — against multiple U.S. critical-sector organizations. Activity began in early February 2026 and continued through publication, coinciding with a sharp escalation in U.S.-Israel-Iran tensions including a February 28, 2026 U.S./Israeli military operation against Iran and the March 1, 2026 reported killing of Iran's Supreme Leader. Confirmed victims include a U.S. bank, a U.S. airport, a U.S. software company that supplies the defense and aerospace industries (with Israeli operations that appear to be the primary target), and non-governmental organizations in both the U.S. and Canada.

The campaign introduced two previously undocumented backdoors. Dindoor is a JavaScript backdoor executed via the Deno runtime — an unconventional execution environment that lets the actor run command-and-control logic outside traditional shell tooling — and was deployed on the software supplier's Israeli branch, the U.S. bank, and the Canadian NGO. Fakeset is a Python backdoor found on the U.S. airport and a non-profit, distributed from Backblaze cloud-storage servers. Both implants were signed with code-signing certificates issued to 'Amy Cherne'; Fakeset additionally used a certificate issued to 'Donald Gay' that Seedworm had previously used to sign its Stagecomp loader and Darkcomp payload, providing high-confidence attribution to the same actor. Microsoft detects Fakeset as Trojan:Python/MuddyWater.DB!MTB and Kaspersky as Backdoor.Python.MuddyWater.a.

The operators relied on legitimate cloud infrastructure for both staging and exfiltration: malware and second-stage payloads were hosted in Backblaze B2 buckets (gitempire and elvenforest), C2 used HTTPS application-layer protocols blended with legitimate cloud traffic, and the actors attempted to exfiltrate data from the software company using the Rclone utility to an attacker-controlled Wasabi cloud-storage bucket. Tradecraft consistent with Seedworm and the broader Iranian-aligned ecosystem in this reporting included spear-phishing and 'honeytrap' social-engineering for initial access and credential theft, remote-access tooling (AnyDesk, ScreenConnect, PDQ), ReGeorg web shells, the HTTPSnoop traffic tool, and a custom browser credential stealer. Symantec situates this campaign within a wider surge of Iranian APT and hacktivist activity against U.S., Canadian, and Israeli targets by groups including Marshtreader (Agrius/Agonizing Serpens), Druidfly (Homeland Justice), Damselfly (Charming Kitten), Mantis (Arid Viper), Handala, and DieNet — some of which exploited internet-exposed cameras via CVE-2023-6895 and CVE-2017-7921. Defenders should hunt for anomalous Deno runtime installations and execution, suspicious Python/JavaScript implant behavior, Rclone activity to Wasabi/Backblaze, and the documented file-hash, domain, and certificate indicators.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1505 Server Software Component
- T1553 Subvert Trust Controls
- T1027 Obfuscated Files or Information
- T1110 Brute Force
- T1555 Credentials from Password Stores
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1074 Data Staged

## Sources

- [Seedworm: Iranian APT on Networks of U.S. Bank, Airport, Software Company](https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us)
- [Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html)
- [Iranian APT Hacked US Airport, Bank, Software Company](https://www.securityweek.com/iranian-apt-hacks-us-airport-bank-software-company/)
- [Iran intelligence backdoored US bank, airport networks](https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/)
- [Iran-linked APT targets US critical sectors with new backdoors](https://www.helpnetsecurity.com/2026/03/06/seedworm-muddywater-backdoors-victims/)
- [MuddyWater's Dindoor Backdoor: Iranian APT Targets U.S. Organizations via Deno Runtime and Cloud Storage](https://www.rescana.com/post/muddywater-s-dindoor-backdoor-iranian-apt-targets-u-s-organizations-via-deno-runtime-and-cloud-sto)
- [Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations](https://securityaffairs.com/189060/apt/iran-linked-muddywater-deploys-dindoor-malware-against-u-s-organizations.html)
- [Iranian APT group MuddyWater targets multiple US companies](https://www.scworld.com/news/iranian-apt-group-muddywater-targets-multiple-us-companies)
- [CISA Advisory AA22-055A: Iranian Government-Sponsored MuddyWater APT](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0757