Seedworm APT Abuses Signed Binaries for DLL Sideloading

**Seedworm (MuddyWater) conducted a stealthy, multi‑continent cyber‑espionage campaign in early 2026 targeting high‑value organizations across manufacturing, government, education, finance, and aviation.** The group abused legitimately signed Fortemedia and SentinelOne binaries to sideload malicious DLLs (including a ChromElevator infostealer), used Node.js as an orchestration parent process to deliver PowerShell reconnaissance and credential‑harvesting scripts, leveraged Kerberos delegation for TGT theft, and exfiltrated data via public file‑sharing (sendit.sh); the report includes hashes, IPs, domains, and a Feb 20–27 intrusion timeline.