MuddyWater Targets U.S. Entities Amid Geopolitical Tensions

In early 2026 the Iranian APT MuddyWater conducted cyberattacks against U.S. banking, a major airport, and Israeli operations of a U.S. software company, deploying a new backdoor called Dindoor and exfiltrating data using Rclone to Wasabi; the group is reported to be actively exploiting CVE-2024-30088 (listed on CISA's KEV) and leveraging legitimate tools to blend with normal enterprise activity, posing increased risk to critical infrastructure.