Stagecomp

Stagecomp is a malware family, commonly described as a downloader, associated with the Iranian threat actor Seedworm, also known as MuddyWater. Multiple sources in the provided content state that Stagecomp has been linked to Seedworm by Google, Microsoft, and Kaspersky. Its primary documented role is to deliver the Darkcomp backdoor. Samples of Stagecomp were signed with a code-signing certificate issued to the name "Donald Gay," and this certificate reuse is repeatedly cited as an attribution artifact connecting Stagecomp and related activity to MuddyWater/Seedworm. The malware is discussed in the context of Seedworm operations targeting organizations, including U.S. entities, and sectors such as government, defense, telecommunications, oil and gas, banking, aviation, and non-profits. In the reporting provided, Stagecomp itself was not observed on victim networks in the 2026 intrusions, but historical overlap in certificates and tooling was used to support attribution of newer MuddyWater malware families such as Dindoor and Fakeset. High-confidence indicators directly mentioned in the content include the malware name Stagecomp, its function as a downloader for Darkcomp, its association with the "Donald Gay" certificate, and its attribution to Seedworm/MuddyWater.