Iran-Linked Hackers Abuse Legitimate Deno Runtime to Hide Dindoor Backdoor on Windows Systems

Iran-linked MuddyWater operators deployed a Windows backdoor called Dindoor that hijacks the legitimate Deno runtime (downloaded via curl.exe) to execute Base64-encoded JavaScript/TypeScript payloads; the campaign uses signed/common binaries, layered obfuscation, virtualization checks to evade sandboxes, and script-based persistence (wscript.exe VBScript in AppData with a Run key) to maintain stealth and communicate with C2 over obfuscated TCP.