Summary:

Recent intelligence indicates an escalation in Iranian state-sponsored cyber operations linked to the MuddyWater advanced persistent threat (APT) group, which is associated with Iran’s Ministry of Intelligence and Security (MOIS). The campaign has primarily targeted organizations in sectors such as banking, aviation, nonprofit institutions, and defense supply chains across the United States and allied nations.

Attackers have deployed a newly identified backdoor known as Dindoor, which leverages the Deno JavaScript runtime to establish persistent access within compromised environments. The malware enables remote command execution and may facilitate data exfiltration through cloud-based infrastructure. The activity reflects Iran’s increasing reliance on credential compromise, cloud abuse, and targeted intrusion campaigns during periods of geopolitical tension, highlighting the need for stronger identity protection, network monitoring, and defensive security controls.

Technical Description:

The intrusion activity attributed to the Iranian-affiliated MuddyWater group involves the deployment of a newly identified backdoor called Dindoor. This malware leverages the Deno JavaScript runtime to execute malicious scripts and maintain persistent access within compromised networks.

Following initial access through spear-phishing, credential compromise, or exploitation of vulnerable services, attackers establish persistence and introduce additional tools to support post-exploitation activities. Observed tooling includes the Python-based Fakeset backdoor and the file synchronization utility Rclone, which is used to stage and potentially exfiltrate data to external cloud storage platforms.

The malware payloads are delivered from trusted cloud infrastructure and digitally signed using certificates previously associated with MuddyWater-linked malware families such as Stagecomp and Darkcomp. This approach allows attackers to blend malicious activity with legitimate cloud traffic while conducting reconnaissance, lateral movement, and data collection inside targeted environments. The details and technicalities of the attack campaign are discussed further,

Delivery and Infection Chain:

Initial access in the campaign is most likely achieved through spear-phishing campaigns, credential harvesting, or the exploitation of vulnerable internet-facing services. MuddyWater operators frequently rely on compromised credentials, social engineering, and password spraying rather than zero-day vulnerabilities to enter targeted environments.

In this campaign, malware payloads, including the Fakeset Python backdoor, were downloaded from legitimate cloud infrastructure, enabling attackers to bypass traditional security controls and disguise malicious activity within legitimate network traffic. The Infection chain was identified as follows,

• The attack typically begins with initial access through spear-phishing, credential harvesting, or password spraying targeting user accounts or externally exposed services within the victim organization.
• After gaining access, attackers establish a foothold in the environment and conduct reconnaissance to identify valuable systems, user privileges, and network architecture while preparing for further payload deployment.
  
• The operators then deploy the Dindoor backdoor, which uses the Deno JavaScript runtime to execute malicious scripts and maintain persistent communication with attacker-controlled command-and-control infrastructure.
  
• Additional malware such as the Fakeset Python backdoor may be deployed to maintain redundant access and facilitate lateral movement across compromised systems.
  
• Finally, attackers leverage tools such as Rclone to stage and potentially exfiltrate sensitive data to attacker-controlled cloud storage services, enabling long-term espionage and data theft.

Technical Capabilities:

The primary capability observed in this campaign is the deployment of the Dindoor backdoor, which uses the Deno JavaScript runtime to execute malicious scripts on compromised systems. By leveraging a lightweight runtime environment commonly associated with legitimate development operations, the malware can blend into normal system processes and evade detection.

The backdoor establishes persistent communication with attacker-controlled command-and-control infrastructure, enabling attackers to issue commands, execute scripts, gather system information, and maintain long-term access within targeted environments.

In addition to Dindoor, attackers deploy auxiliary tools to expand operational capabilities and maintain redundancy within compromised networks. The Fakeset Python-based backdoor provides an alternative access mechanism, ensuring continued control even if one access channel is disrupted.

Attackers also utilize legitimate tools such as Rclone to stage and exfiltrate sensitive data to external cloud storage providers. By embedding malicious operations within legitimate network activity, the attackers reduce the likelihood of detection while enabling stealthy reconnaissance, lateral movement, and data exfiltration. These capabilities demonstrate a threat actor focused on long-term espionage and covert intelligence collection.

Attribution and Evolution:

The activity has been attributed to MuddyWater, also known as Seedworm, an Iranian state-sponsored threat group linked to the Ministry of Intelligence and Security. Historically, MuddyWater has targeted financial institutions, telecommunications providers, government organizations, and critical infrastructure sectors across multiple regions.

Over time, the group has evolved from relying on simple scripting techniques and commodity malware toward developing more sophisticated tooling, including custom backdoors and improved operational security measures designed to evade attribution and detection.

Active Campaign and Geographic Spread:

Recent activity associated with this campaign has targeted organizations in North America, including the United States and Canada, across sectors such as banking, aviation, nonprofit organizations, and defense-related software providers.

The campaign has also emerged within the broader context of rising geopolitical tensions involving Iran, Israel, and Western allies. Simultaneously, scanning and exploitation attempts have been reported against internet-connected edge devices and surveillance infrastructure across the Middle East and Gulf region, including the United Arab Emirates, Qatar, Bahrain, and Kuwait.

Conclusion:

The discovery of the Dindoor backdoor highlights the continued expansion of Iranian cyber capabilities and the strategic role of cyber operations in geopolitical conflicts. MuddyWater’s use of legitimate cloud infrastructure, credential-based access techniques, and lightweight malware frameworks demonstrates a deliberate emphasis on stealth, persistence, and operational flexibility.

Organizations should strengthen monitoring of cloud activity, implement robust identity security controls, and restrict exposure of internet-facing systems in order to mitigate the risks posed by similar intrusion campaigns.

Impact:

The discovery of the Dindoor backdoor highlights the continued expansion of Iranian cyber capabilities and the strategic role of cyber operations in geopolitical conflicts. MuddyWater’s use of legitimate cloud infrastructure, credential-based access techniques, and lightweight malware frameworks demonstrates a deliberate emphasis on stealth, persistence, and operational flexibility.

Organizations should strengthen monitoring of cloud activity, implement robust identity security controls, and restrict exposure of internet-facing systems in order to mitigate the risks posed by similar intrusion campaigns.

IOC and Context Details:

‍

‍

Recommended Actions:

• Implement phishing-resistant multi-factor authentication across all user accounts, particularly for privileged accounts and remote access services, to reduce the risk of credential compromise and password spraying attacks.
• Conduct regular patch management and vulnerability remediation for internet-facing systems, including VPN gateways, edge devices, and surveillance infrastructure.
  
• Restrict and monitor the use of administrative privileges and remote access tools while enforcing the principle of least privilege.
  
• Enhance network monitoring and logging to detect unusual outbound connections, suspicious command execution activity, and communication with external cloud storage services.
  
• Implement network segmentation to restrict lateral movement and isolate critical systems such as financial platforms, operational technology, and sensitive databases.
  
• Monitor for abnormal usage of legitimate tools such as Rclone or scripting environments that may be abused for data staging or data exfiltration.
  
• Strengthen email security controls and user awareness programs to reduce the likelihood of successful spear-phishing or social engineering attacks.
• Maintain secure offline backups of critical data and ensure tested incident response procedures are in place to enable rapid containment and recovery in the event of compromise.

Reference:

https://www.infosecurity-magazine.com/news/iran-muddywater-hackers-us-firms/

https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/