Security researchers from Symantec and Carbon Black have identified a new campaign by the Iran-linked threat actor MuddyWater (also known as Seedworm) targeting U.S. and Israeli networks. This operation involves the deployment of a previously unknown backdoor named Dindoor.

Campaign Overview

The campaign, which surfaced in early 2026, focuses on critical infrastructure and financial services.

• Targets: Victims include a U.S. bank, a U.S. airport, and the Israeli branch of a software company supplying the defense and aerospace industries.
• Attribution: Analysts linked the activity to MuddyWater via digital certificates issued to “Amy Cherne,” a signature previously used by the group to sign other malware like Darkcomp.

The Dindoor Backdoor

Dindoor represents an evolution in MuddyWater’s toolkit, moving toward more sophisticated, stealthy execution.

• Execution Environment: It leverages the Deno JavaScript runtime for execution, which is unusual for this threat actor and helps it evade standard detection.
• Functionality: Once embedded, it allows attackers to maintain persistence, execute arbitrary commands, and exfiltrate sensitive data.
• Secondary Malware: Researchers also discovered a second Python-based backdoor called Fakeset on several of the same compromised networks.

Recent Tooling Evolution

This activity is part of a broader trend of MuddyWater modernizing its arsenal. Other recently deployed tools include:

• MuddyViper: A custom backdoor often disguised as a “Snake” video game.
• CHAR: A Rust-based backdoor controlled via Telegram bots.
• BugSleep: A tailor-made backdoor used primarily against Israeli organizations.