Darkcomp

Darkcomp is a backdoor malware family linked in public reporting to the Iranian threat actor Seedworm, also known as MuddyWater. Multiple sources in the provided content state that Google, Microsoft, and Kaspersky linked Darkcomp to Seedworm, and that the malware was signed in some cases with the code-signing certificate issued to “Donald Gay.” Darkcomp is also described as being delivered by the Stagecomp downloader, with several reports explicitly stating that Stagecomp is designed to deploy or download the Darkcomp backdoor.

In the intrusion activity described by Rapid7, attackers assessed with medium/moderate confidence to be MuddyWater used valid credentials obtained through Microsoft Teams-based social engineering and phishing, then used RDP and curl to deploy payloads that included Darkcomp, a malicious Microsoft WebView2 loader intended to disguise traffic, and an encrypted configuration file that sent instructions to Darkcomp. The broader campaign involved credential harvesting, MFA manipulation, remote access via tools such as AnyDesk and DWAgent, lateral movement using compromised accounts, and theft of sensitive data. Rapid7 assessed that the operation was disguised as a Chaos ransomware incident to conceal espionage activity or preposition for possible future destructive attacks.

The content also places Darkcomp within a broader MuddyWater malware ecosystem that includes Stagecomp, Dindoor, and Fakeset, and notes reporting tying these malware families to targeting of U.S. entities. High-confidence details directly supported by the content are that Darkcomp is a backdoor, that Stagecomp delivers/downloads it, that the “Donald Gay” certificate was previously used to sign Darkcomp-related malware, and that the malware has been associated with Seedworm/MuddyWater in reporting by Google, Microsoft, Kaspersky, Broadcom/Symantec, PolySwarm, and Rapid7.