# Iran Conflict Cyber Operations: MuddyWater (Seedworm) Deploys New Dindoor and Fakeset Backdoors Against US Banks, Airports, Non-Profits, and Defense/Aerospace Software Providers (Feb-Mar 2026)

> Iranian state-aligned actor MuddyWater (Seedworm/TEMP.Zagros/Mango Sandstorm), subordinate to Iran's Ministry of Intelligence and Security, has run a sustained intrusion campaign since early February 2026 against a U.S. bank, a U.S. airport, U.S./Canadian non-profits, and the Israeli operations of a U.S. defense/aerospace software supplier, deploying two previously-unseen backdoors (Dindoor, Fakeset) and attempting cloud-based data exfiltration via Rclone. Avertium assesses this activity as part of a broader, sustained elevation in global cyber risk tied to the Iran-Israel-U.S. conflict that began with coordinated strikes on February 28, 2026.

- **Published:** 2026-03-17T00:00:00Z
- **Last reviewed:** 2026-03-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2114
- **ID:** TL-2026-2114
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Broadcom's Symantec Threat Hunter Team and independent reporting (The Hacker News, SecurityAffairs) document an Iranian state-sponsored intrusion set, attributed to MuddyWater (aka Seedworm, Earth Vetala, MERCURY, Static Kitten, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill), active against multiple U.S. and allied organizations since early February 2026. Victims include a U.S. bank, a U.S. airport, a U.S. non-governmental organization, a Canadian non-profit, and the Israeli operations of a U.S. software company that supplies the defense and aerospace industry. US Cyber Command and CISA (joint advisory AA22-055A) previously and officially attributed MuddyWater to a subordinate element of Iran's Ministry of Intelligence and Security (MOIS), active since at least 2017 with a history of targeting telecommunications, government, defense, and energy-sector organizations for espionage.

The February-March 2026 activity introduces two malware families not previously catalogued in MuddyWater's arsenal. Dindoor is a JavaScript-based backdoor that executes via the Deno secure runtime and was found on the Israeli software-company network, the U.S. bank, and the Canadian non-profit; samples were digitally signed with a certificate issued to "Amy Cherne." Fakeset is a Python-based backdoor deployed against the U.S. airport and non-profit networks, distributed from attacker-controlled Backblaze B2 cloud-storage buckets and signed with certificates ("Amy Cherne," "Donald Gay") that were previously used to sign the related Stagecomp downloader and Darkcomp backdoor -- both malware families independently linked to Seedworm by Google, Microsoft, and Kaspersky. Microsoft detects Fakeset as "Trojan:Python/MuddyWater.DB!MTB" and Kaspersky as "Backdoor.Python.MuddyWater.a." Post-compromise, the actor attempted data exfiltration using the Rclone utility to copy files from a compromised host to a Wasabi cloud-storage bucket, though successful exfiltration could not be confirmed.

Avertium's parallel Cyber Threat Analysis (CTA) assessment, synthesizing reporting from Microsoft DTI, Google GTIG, Unit 42, SentinelOne, Recorded Future, Check Point, Broadcom/Symantec, and CISA/FBI/NSA/DC3, characterizes this as one strand of a measurably elevated, sustained Iranian cyber-operations campaign that accelerated after the February 28, 2026 coordinated U.S.-Israeli military strikes on Iran (which killed Iran's Supreme Leader Ali Khamenei along with senior military leadership). Avertium's broader TTP profile for this campaign cycle -- spear phishing with geopolitical lures, trusted-document/macro abuse, exploitation of unpatched edge devices (VPN/web-facing services), PowerShell-based execution, registry and service-based persistence, encrypted HTTP/S C2 over legitimate cloud/CDN infrastructure, credential harvesting/browser data theft, and network discovery/lateral movement staging -- is consistent with, and corroborated by, the concrete Dindoor/Fakeset intrusion set. Avertium's outlook warns of a three-phase escalation culminating in potential destructive operations against critical infrastructure (energy, utilities, telecom, transportation, healthcare) if the conflict continues. No CVEs are cited by either the Avertium assessment or the Dindoor/Fakeset reporting; this is a TTP- and malware-driven intrusion campaign rather than a single-vulnerability exploit chain.

## MITRE ATT&CK

- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1553 Subvert Trust Controls
- T1090 Proxy
- T1555 Credentials from Password Stores
- T1087 Account Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration

## Sources

- [CTA Campaign Assessment: The Iran Conflict - Global Cyber Operations Risk](https://www.avertium.com/resources/threat-reports/cta-campaign-assessment-the-iran-conflict-global-cyber-operations-risk)
- [Seedworm: Iranian APT on Networks of U.S. Bank, Airport, Software Company](https://www.security.com/threat-intelligence/iran-cyber-threat-activity-us)
- [Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html)
- [Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations](https://securityaffairs.com/189060/apt/iran-linked-muddywater-deploys-dindoor-malware-against-u-s-organizations.html)
- [MuddyWater, Earth Vetala, MERCURY, Static Kitten, Seedworm, TEMP.Zagros, Mango Sandstorm, TA450, MuddyKrill, Group G0069](https://attack.mitre.org/groups/G0069/)
- [Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks (AA22-055A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a)
- [Iran's supreme leader, Ayatollah Ali Khamenei, has been killed](https://www.npr.org/2026/02/28/nx-s1-5730158/israel-iran-strikes-trump-us)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2114