The WatchGuard Geopolitical Cyber Report: Iran-Affiliated Cyber-Espionage Against Global High-Value Organizations

**Executive summary:** Iran-linked MuddyWater (Seedworm) ran an active, global espionage campaign in early 2026 targeting electronics, aviation, finance, education and government; attackers used trusted/signed binaries with DLL side‑loading, a Node.js-based loader to run PowerShell scripts, ChromElevator to harvest Chromium-based browser credentials and cookies, registry-based credential dumping, and exfiltration via a public file-transfer service (sendit.sh); the report provides IOCs, MITRE ATT&CK mappings and tiered mitigation steps emphasizing behavioral detection over signature-only controls.