MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries

Symantec, Carbon Black, Broadcom and other researchers attribute a coordinated early‑2026 espionage and exfiltration campaign to Iran-linked operators (notably MuddyWater/Seedworm and MOIS-affiliated actors). The adversaries used DLL side‑loading of signed Fortemedia and SentinelOne binaries to run malicious DLLs (including ChromElevator) that exfiltrate browser credentials and payment data, Node.js/PowerShell implant chains for reconnaissance and lateral movement, and bespoke tools (FileFiend) and public file services to stage stolen data; some U.S. victims also experienced destructive actions.