Iran's MuddyWater Hackers Hit US Firms with New 'Dindoor' Backdoor

Symantec/Carbon Black Threat Hunters uncovered an active campaign since early February attributed to Iran-linked MuddyWater targeting multiple US and Canadian organizations (a bank, an airport, NGOs and a defense-sector software subsidiary). The attackers deployed a Deno-based backdoor named “Dindoor” and a Python backdoor “Fakeset,” attempted cloud exfiltration using Rclone to a Wasabi bucket, and reused code-signing certificates previously linked to MuddyWater, providing forensic ties to the group.