Iranian APT, MuddyWater, Targeting US Networks Using Dindoor and Fakeset Backdoors in New Campaign

The Iranian cyber espionage group MuddyWater, also popularly known as Seedworm and MANGO SANDSTORM, has been conducting a coordinated campaign since early February 2026, targeting organizations in the U.S., Israel, and Canada. This campaign, aligned with Iran’s Ministry of Intelligence and Security (MOIS), uses advanced techniques to maintain stealth and persistence, leveraging malware families like Dindoor and Fakeset. Dindoor utilizes the Deno runtime, while Fakeset is a Python-based backdoor, both aiding in data exfiltration and minimizing detection. The campaign focuses on strategically significant entities, including a U.S. bank, a U.S. airport, a Canadian non-profit, and an Israeli subsidiary of a U.S. defense software company. These targets provide intelligence value and potential leverage amidst heightened geopolitical tensions following U.S. and Israeli military actions against Iran. MuddyWater’s operations blend malicious traffic with legitimate cloud services, complicating attribution and detection. Broadcom’s Symantec and Carbon Black have linked MuddyWater to recent network infiltrations, identifying attempts to exfiltrate data using Rclone to Wasabi cloud storage. The group employs sophisticated social engineering tactics, such as spear-phishing and “honeytrap” operations, to access sensitive information. Their activities are part of a broader Iranian strategy to conduct cyber operations as retaliatory measures against perceived adversaries. The ongoing geopolitical conflict in the Middle East has intensified cyber activities, with Iranian actors targeting vulnerable infrastructure in Israel and Gulf countries. The UK’s National Cyber Security Centre warns of potential threats from Iran-linked hacktivists. MuddyWater’s advanced tactics, including the use of legitimate cloud infrastructure and minimal static indicators, highlight a shift towards behavioral stealth and post-signature operational models, posing significant challenges for detection and defense. CTIX Analysts will continue monitoring relevant threat actor activities. A list of Indicators of Compromise (IOCs) and network indicators can be found in the Krypt3ia report linked below.