High

Analysis Summary

In early 2026, Iranian cyber operations intensified, with state-linked threat actors, including the APT group MuddyWater, embedding themselves in US and Canadian networks. Targeted sectors included banking, aviation, defense supply chains, and non-profit organizations. Investigations by Reesearcher revealed that MuddyWater maintained unauthorized access since February 2026, deploying undocumented malware to establish persistent footholds. The group’s campaign focused on long-term intelligence collection rather than immediate disruption, highlighting its state-sponsored espionage objectives. Malware families associated with these operations included Dindoor, Fakeset, Stagecomp, and Darkcomp, each tailored for stealth and long-term network access.

MuddyWater’s Dindoor backdoor targeted a US software company in the defense and aerospace sector, leveraging the Deno runtime for command execution. Fakeset, a Python-based backdoor, was discovered on the networks of a US airport and a non-profit organization, both engineered to remain undetected while preserving persistent access. The presence of these tools underscores the sophistication and strategic focus of Iran’s cyber espionage efforts, which rely on custom malware and long-term infiltration rather than overt attacks. Digital certificates previously linked to MuddyWater were used to sign malware, indicating a coordinated and traceable campaign.

Beyond network intrusions, Iranian operators exploited internet-connected surveillance cameras across the Middle East, targeting devices from Hikvision and Dahua. Research observed scanning and exploitation activity beginning February 28, 2026, coinciding with the onset of regional hostilities. Vulnerabilities such as CVE-2017-7921 and CVE-2021-33044 were leveraged to monitor emergency response movements and assess post-strike damage, turning everyday security cameras into low-cost battlefield intelligence platforms. This tactic, first seen during the June 2025 Iran-Israel conflict, demonstrates Iran’s repeated use of IP camera exploitation for operational awareness, taking advantage of outdated firmware and lack of standard monitoring.

Iran-aligned hacktivist group Handala further expanded this threat landscape, claiming a destructive attack against Stryker, a Fortune 500 medical technology firm, which included exfiltration of roughly 50 terabytes of data and deployment of wiper malware. Organizations using vulnerable cameras are advised to apply all firmware patches, segment camera networks from core systems, disable unnecessary remote access, enforce strong authentication, and monitor for unusual outbound traffic. For MuddyWater-targeted sectors, detecting Dindoor and Fakeset involves monitoring anomalous Deno or Python activity and outbound Rclone traffic. Certificate-based detection and proactive incident response are critical to mitigating these high-priority risks amid the ongoing geopolitical tensions.

Impact

• Sensitive Data Theft
• Gain Access
• Financial Loss

Indicators of Compromise

SHA1

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Monitor for unusual Deno runtime or Python processes on endpoints.
• Inspect outbound Rclone traffic that could indicate data exfiltration.
• Implement certificate-based detection to identify malware signed with known MuddyWater certificates.
• Isolate critical networks and apply strict segmentation to limit lateral movement.
• Regularly update and patch all software to prevent exploitation of known vulnerabilities.
• Conduct continuous threat hunting for persistent malware families like Dindoor, Fakeset, Stagecomp, and Darkcomp.
• Ensure robust logging and monitoring to detect anomalous activity promptly.
• Apply all available firmware patches, especially addressing CVE-2017-7921, CVE-2021-36260, CVE-2023-6895, CVE-2025-34067, and CVE-2021-33044.
• Segment camera networks from core enterprise networks to prevent lateral movement.
• Disable unnecessary remote access features on cameras.
• Enforce strong authentication for all connected devices.
• Monitor outbound traffic from camera systems for signs of active exploitation.
• Replace or decommission outdated or unsupported devices that cannot be patched.
• Treat persistent footholds as high-priority risks given current geopolitical tensions.
• Conduct tabletop exercises to simulate malware intrusion and camera exploitation scenarios.
• Implement regular backups and validate recovery processes to minimize data loss.
• Use threat intelligence feeds to stay updated on emerging Iran-linked campaigns.