Loading story…
Researchers detailed a DinDoor backdoor campaign that delivers malware through MSI installers and abuses the legitimate Deno runtime to blend malicious activity with trusted software. Two analyzed samples, Installer_v1.21.66.msi and migcredit.pdf.msi, both fingerprint infected hosts and beacon to command-and-control infrastructure, but use different execution chains, payload delivery methods, and callback timing. One sample contacted serialmenot[.]com using a hardcoded JWT embedded in the C2 path, and decoded campaign metadata linked the infrastructure to activity previously associated with MuddyWater/Seedworm and CastleLoader.
The second sample used a double-extension lure likely themed around MigCredit and relied on obfuscated JavaScript with a separate C2 path and beacon interval. Hunt.io said distinctive HTTP response traits across the infrastructure enabled identification of 20 active DinDoor C2 servers spanning multiple autonomous systems. The findings suggest DinDoor is not tied to a single operator, but instead appears to function as a shared or multi-tenant malware platform used by multiple threat actors.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Based on differences between the samples and the spread of infrastructure, researchers concluded DinDoor likely operates as a shared or multi-tenant malware platform rather than being controlled by a single operator. This assessment was published in Hunt.io's analysis.
Using distinctive HTTP response characteristics associated with DinDoor infrastructure, researchers identified 20 active command-and-control servers across multiple autonomous systems. The findings suggested the malware was operating on broader shared infrastructure.
A separate sample, migcredit.pdf.msi, was identified using obfuscated JavaScript and a double-extension filename likely intended to lure MigCredit-related targets. It used a different C2 path and beacon interval from the other MSI sample.
Analysis of the Installer_v1.21.66.msi sample revealed a hardcoded JWT in its C2 path to serialmenot[.]com, exposing campaign metadata. The infrastructure overlap reinforced links to activity previously associated with MuddyWater/Seedworm and CastleLoader.
Two MSI-delivered DinDoor samples were observed installing or invoking the legitimate Deno runtime to execute a backdoor while fingerprinting infected hosts and communicating with command-and-control infrastructure. The samples differed in execution flow, payload delivery, and beaconing behavior, indicating multiple delivery variants within the campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceinfosec.pub
Open sourcehunt.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a malware campaign that used fake installers and plugins on **GitHub** and **SourceForge** to impersonate popular software including **ChatGPT**, **Claude**, **AutoTune**, **Kontakt**, and **Ableton Live**, ultimately delivering the Deno-based backdoor **DinDoor**. The operation was promoted through compromised YouTube channels that posted AI-generated videos linking to malicious repositories; those videos reportedly drew more than **50,000 views** before takedowns. Infection chains typically relied on malicious MSI installers or PowerShell-based loaders that installed **Scoop** and **WinGet**, then deployed the **Deno** runtime to fetch and execute staged JavaScript payloads from attacker-controlled infrastructure. Once installed, DinDoor established persistence, profiled infected systems, and fetched additional malware including a Deno-based RAT capable of **remote execution**, **data theft**, **screenshot capture**, **SOCKS5 proxying**, and browser credential theft. Researchers said the malware also targeted **Telegram**, **Discord**, **Lightcord**, more than **50 crypto wallet extensions**, and at least **10 crypto wallet applications**. A standout capability used **Microsoft Edge**, the **Chrome DevTools Protocol**, and **WebRTC** to stream victim screens peer-to-peer while blending malicious traffic with legitimate browser activity. GitHub removed the identified repositories, but researchers warned the operators are likely to keep recreating malicious accounts and projects on trusted platforms.
Jun 29, 2026
Iran-linked **MuddyWater** operators have used the Dindoor backdoor after spearphishing compromises of Windows environments, targeting U.S. software and banking organizations and a Canadian non-profit. The malware abuses the legitimate signed `deno.exe` JavaScript and TypeScript runtime to execute Base64-encoded payloads, reducing the effectiveness of static and hash-based detections. The multi-stage chain inventories infected hosts, contacts a remote server, and checks for virtualized analysis environments, including PowerShell queries of `Win32_VideoController` to identify graphics hardware. Persistence is established through a Windows Run registry key that launches a VBS file—reported as `SerialLynx_system59.vbs` under a local AppData path—via `wscript.exe`; defenders should investigate anomalous Deno execution, unapproved Deno downloads using `curl.exe`, script-host activity, and Run keys invoking scripts from AppData Local.
Aug 26, 2026
eSentire reported that a June 2026 intrusion against a finance-sector customer began with a **ClickFix-style social engineering lure** that triggered a malicious command, an MSI installer, and a multi-stage malware chain attributed to **TAG-150**. The infection sequence used an apparently AI-generated PowerShell script, `Griffin20.ps1`, to install the **Deno** runtime and launch the Deno-based loader **DinDoor**, which then deployed **DenoRAT** and ultimately **NightshadeC2**. Investigators said the malware communicated with command-and-control infrastructure including `webstizkgao[.]com` and used hard-coded JWTs carrying campaign identifiers such as `buildId 0def066f14754be9` and `buildNote LearnV7msi`. The tooling provided broad post-compromise capability, with **DenoRAT** functioning as a RAT, loader, and stealer that supported command execution, persistence, host fingerprinting, file operations, screenshots, PTY and VNC-style remote control, and theft from browsers and cryptocurrency wallets. eSentire said the malware could also bypass Chromium App-Bound Encryption through **DLL injection**, a technique widely associated with in-memory execution, evasion, and abuse of legitimate Windows processes in ATT&CK `T1055.001`. The final **NightshadeC2** payload was delivered through a PowerShell-driven Python in-memory loader, decrypted from an encrypted container using **AES-256-CBC** with a key derived from `MoscauHighSmoke`, and reflectively mapped into a Python process before the affected host was isolated and remediated.
Jul 17, 2026