MuddyWater-Linked Dindoor Backdoor Abuses Legitimate Deno Runtime to Evade Detection

Researchers attribute a backdoor called Dindoor to the MuddyWater APT; the malware abuses the legitimate Deno JavaScript/TypeScript runtime (downloading deno.land if needed) to run Base64-encoded scripts, performs multi-stage payload retrieval and sandbox/VM detection via a WMI video controller query, establishes persistence via a Run key executing a VBScript (Lynx_system59.vbs), and uses signed tools (curl.exe, deno.exe, wscript.exe, PowerShell) for C2 and concealment — infections were observed at U.S. software and banking organizations and a Canadian non-profit.