Iranian APT Seedworm intensifies cyberespionage against US and Israeli networks using a new stealth backdoor called Dindoor. Read the full threat report.

Iran-linked MuddyWater hackers breached U.S. networks with new Dindoor malware as regional cyber attacks escalate amid Middle East conflict.

Iran-linked APT MuddyWater targeted U.S. organizations, deploying the new Dindoor backdoor across sectors including banks, airports, and nonprofits.

Iran-linked MuddyWater hackers breached U.S. networks with new Dindoor malware as regional cyber attacks escalate amid Middle East conflict.

Iran-linked MuddyWater hackers breached U.S. networks with new Dindoor malware as regional cyber attacks escalate amid Middle East conflict.

Iran-linked MuddyWater hackers breached U.S. networks with new Dindoor malware as regional cyber attacks escalate amid Middle East conflict.

Iran-linked operators are using a trusted developer tool to conceal a backdoor called Dindoor inside Windows environments. The malware uses the Deno JavaScript and TypeScript runtime to execute encod…

Researchers say Iran's MuddyWater hackers targeted US companies and an Israeli software firm’s department in a cyber campaign using the Dindoor malware - All this amid the ongoing conflict.

Iran-linked MuddyWater hackers breached U.S. networks with new Dindoor malware as regional cyber attacks escalate amid Middle East conflict.

The Threat Hunter Team reports a surge in cyberespionage by Iranian-linked APT Seedworm targeting multiple U.S. organizations and companies—often those with ties to Israel—since early February 2026. Researchers uncovered a previously undocumented backdoor named Dindoor across several victims, while hacktivist group Handala has used partial data leaks to amplify attacks, elevating...

A bank, an airport, a non-profit and the Israeli branch of a US software company were among the targets of this new MuddyWater campaign

Follow us on all social media platforms @Hackread

MuddyWaterに関連するイラン系脅威アクターが、新たに確認されたWindowsバックドア「Dindoor」を使用しています。このマルウェアは正規のDenoランタイムを乗っ取り、悪意あるJavaScriptおよびTypeScriptペイロードを実行する仕組みです。 今回のキャンペーンは、信頼された開発者向けツール

Date: March 2026By: Krypt3ia Executive Summary In early February 2026, the Iranian state-aligned cyber espionage group MuddyWater (also tracked as Seedworm, MERCURY, Static Kitten, MOIST KEYCH…

Attackers are abusing GitHub, SourceForge, and compromised YouTube channels to distribute fake installers and plugins impersonating popular software such as ChatGPT, Claude, AutoTune, and Kontakt. The campaign delivers DinDoor and a Deno-based RAT that uses alternative JavaScript runtimes, Scoop, and WinGet to install payloads, steal data, and hide traffic through Microsoft...

A technical breakdown of DinDoor and FakeSet — the latest weapons in Seedworm's rapidly expanding arsenal.

Attackers are hosting counterfeit installers and plugins on GitHub and SourceForge that pose as widely used software, including ChatGPT, Claude, AutoTune, Kontakt, Ableton Live, and ZENOLOGY. The downloads deliver a backdoor called DinDoor, which then loads a remote access Trojan built on the Deno JavaScript runtime, according to Malwarebytes. Compromised YouTube channels push victims toward the malicious repositories. The videos promoting the fake tools have accumulated more than 50,000 views. The attackers rotate through GitHub …

O grupo de ciberespionagem iraniano conhecido como MuddyWater (ou Seedworm) foi dado como estando envolvido em operações de intrusão contra redes nos EUA, incluindo bancos e aeroportos, utilizando …

Dindoor is a backdoor that abuses the Deno runtime to execute malware within a target environment. Rather than shipping its own interpreter, Dindoor relies on Deno, a legitimate and widely used JavaScript and TypeScript runtime, and will install that runtime on the victim machine on demand if it is not already present. Few of its individual components are novel; what makes Dindoor effective is the combination of a signed third-party runtime performing execution, base64 encoding at every stage, and an environment check that must pass before the backdoor establishes persistence. After initial staging, the loader confirms whether the Deno runtime is present on the victim machine and, if it is not, downloads it from deno.land via curl.exe. What does not change between builds is the behavior beneath the encoding, and that is where detection must focus: deno.exe launching with a lengthy base64 argument on a host with no developer profile curl.exe reaching out to deno.land on a machine with no legitimate reason to install a JavaScript runtime a Run key directing wscript.exe to a VBScript within a subdirectory of AppData\Local a `Win32_VideoController` WMI query originating from a PowerShell process spawned by cmd.exe Binary Defense researchers developed hypothesis-based threat hunting queries around these patterns, targeting the fixed structure of Dindoor's execution chain rather than the encoded contents that change with each build. By adopting a mainstream developer runtime as its execution engine, MuddyWater gains a legitimate signed binary, a network destination few organizations have reason to block, and a script format that most detection content was never written to address.