Iran-linked APT targets US critical sectors with new backdoors

Symantec and Carbon Black attribute ongoing intrusions since February 2026 to the Iran-linked APT Seedworm (MuddyWater), which has been observed inside US and Israeli-linked networks (including a US bank, an airport, non-profits and a defense supplier) using new backdoors—Dindoor (Deno-based) and Fakeset (Python)—and signed binaries, performing reconnaissance and data exfiltration to Wasabi via rclone; an exposed VPS harvested by researchers revealed extensive C2 tooling, exploitation of multiple CVEs, password-spraying, and broad targeting across regional governments and organizations.