Loading story…
Iran-linked MuddyWater operators have used the Dindoor backdoor after spearphishing compromises of Windows environments, targeting U.S. software and banking organizations and a Canadian non-profit. The malware abuses the legitimate signed deno.exe JavaScript and TypeScript runtime to execute Base64-encoded payloads, reducing the effectiveness of static and hash-based detections.
The multi-stage chain inventories infected hosts, contacts a remote server, and checks for virtualized analysis environments, including PowerShell queries of Win32_VideoController to identify graphics hardware. Persistence is established through a Windows Run registry key that launches a VBS file—reported as SerialLynx_system59.vbs under a local AppData path—via wscript.exe; defenders should investigate anomalous Deno execution, unapproved Deno downloads using curl.exe, script-host activity, and Run keys invoking scripts from AppData Local.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Binary Defense began tracking the Dindoor backdoor and attributed the activity to the Iran-linked MuddyWater threat group. The backdoor was used as a later-stage payload following spearphishing-based intrusions targeting U.S. software and banking organizations and a Canadian non-profit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a **DinDoor** backdoor campaign that delivers malware through MSI installers and abuses the legitimate **Deno** runtime to blend malicious activity with trusted software. Two analyzed samples, `Installer_v1.21.66.msi` and `migcredit.pdf.msi`, both fingerprint infected hosts and beacon to command-and-control infrastructure, but use different execution chains, payload delivery methods, and callback timing. One sample contacted `serialmenot[.]com` using a hardcoded JWT embedded in the C2 path, and decoded campaign metadata linked the infrastructure to activity previously associated with **MuddyWater/Seedworm** and **CastleLoader**. The second sample used a double-extension lure likely themed around **MigCredit** and relied on obfuscated JavaScript with a separate C2 path and beacon interval. Hunt.io said distinctive HTTP response traits across the infrastructure enabled identification of **20 active DinDoor C2 servers** spanning multiple autonomous systems. The findings suggest DinDoor is not tied to a single operator, but instead appears to function as a **shared or multi-tenant malware platform** used by multiple threat actors.
Jun 29, 2026
Iran-linked **MuddyWater** (also tracked as **Seedworm**) was tied to an espionage campaign that compromised at least nine organizations across nine countries and four continents, hitting sectors including manufacturing, education, government, financial services, professional services, telecommunications, and an international airport. Researchers said the group used **DLL side-loading** with legitimate signed binaries such as `fmapp.exe` from Fortemedia and `sentinelmemoryscanner.exe` from SentinelOne to launch malicious DLLs, including the open-source **ChromElevator** tool for browser-data theft. One confirmed victim was a major South Korean electronics manufacturer, where the attackers reportedly maintained access for about a week, while earlier activity also targeted telecom providers in Egypt, Sudan, and Tanzania. The operators combined stealthy execution with a broad post-compromise toolkit, using **Node.js** to launch PowerShell payloads for reconnaissance, screenshot capture, privilege escalation, credential theft, and SOCKS5 reverse-proxy tunneling. Symantec also linked MuddyWater to the **MuddyC2Go** PowerShell framework, use of legitimate remote-management software **SimpleHelp**, and the publicly available **Venom Proxy** to maintain access and move through victim networks. Persistence was established through registry modifications, credentials were harvested through fake login prompts and registry hive dumping, and stolen data was exfiltrated via the public file-transfer service `sendit[.]sh`, indicating a sustained intelligence-collection effort aligned with Iranian state interests.
Jun 29, 2026
Researchers reported a malware campaign that used fake installers and plugins on **GitHub** and **SourceForge** to impersonate popular software including **ChatGPT**, **Claude**, **AutoTune**, **Kontakt**, and **Ableton Live**, ultimately delivering the Deno-based backdoor **DinDoor**. The operation was promoted through compromised YouTube channels that posted AI-generated videos linking to malicious repositories; those videos reportedly drew more than **50,000 views** before takedowns. Infection chains typically relied on malicious MSI installers or PowerShell-based loaders that installed **Scoop** and **WinGet**, then deployed the **Deno** runtime to fetch and execute staged JavaScript payloads from attacker-controlled infrastructure. Once installed, DinDoor established persistence, profiled infected systems, and fetched additional malware including a Deno-based RAT capable of **remote execution**, **data theft**, **screenshot capture**, **SOCKS5 proxying**, and browser credential theft. Researchers said the malware also targeted **Telegram**, **Discord**, **Lightcord**, more than **50 crypto wallet extensions**, and at least **10 crypto wallet applications**. A standout capability used **Microsoft Edge**, the **Chrome DevTools Protocol**, and **WebRTC** to stream victim screens peer-to-peer while blending malicious traffic with legitimate browser activity. GitHub removed the identified repositories, but researchers warned the operators are likely to keep recreating malicious accounts and projects on trusted platforms.
Jun 29, 2026