Dindoor - The Technical Analysis of an Iranian Backdoor

Dindoor is a multi-stage backdoor linked to the Iranian APT MuddyWater that abuses the legitimate Deno JavaScript/TypeScript runtime to execute encoded payloads; it installs Deno if missing, uses base64-encoded stages, performs virtualization checks before establishing persistence via a Run registry key, and exposes a Deno-based TCP listener for C2. Binary Defense observed Dindoor targeting U.S. software and banking firms and a Canadian non-profit, and recommends behavior-based detections focused on the runtime and execution chain rather than static signatures.