Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor

The report details suspected Iranian state-sponsored activity by MuddyWater (Seedworm) embedding in U.S. and Israeli-linked networks, including deployment of a novel Deno-based backdoor called “Dindoor” and a Python backdoor “Fakeset” (signed with certificates linked to other MuddyWater malware), an attempted Rclone-based data exfiltration, and broad exploitation/scanning of IP cameras using multiple CVEs; it contextualizes this activity amid escalating regional conflict and provides mitigation advice for organizations.