The Iranian state-linked group MuddyWater has launched a new espionage campaign impacting at least nine (9) organizations across nine (9) countries and four (4) continents in early 2026. Targets include a major South Korean electronics manufacturer, a Middle Eastern international airport, Southeast Asian industrial firms, and a Latin American financial-services provider, as well as education and public-sector bodies. The attackers rely heavily on DLL sideloading with legitimately signed Fortemedia (fmapp.exe) and SentinelOne (sentinelmemoryscanner.exe) binaries to execute malicious DLLs (fmapp.dll and sentinelagentcore.dll) while appearing benign. These DLLs embed the open-source ChromElevator tool to steal passwords, cookies, and payment card data from Chromium-based browsers, bypassing App-Bound Encryption protections. MuddyWater also uses a Node.js–to–PowerShell implant chain to perform reconnaissance, screenshot capture, SAM hive theft, privilege escalation, SOCKS5 reverse-proxy tunneling, and staging of stolen data on public file-transfer services like sendit.sh. In the South Korean case, they repeatedly re-executed the binaries to maintain access. While none of the techniques are new individually, Symantec and Carbon Black note a clear shift toward quieter, more disciplined, implant-driven operations compared to MuddyWater’s earlier activity.