March 21, 2026, 3:14 p.m.

New Generation Infiltration Operation from Iran-Backed MuddyWater: Dindoor and Fakeset

The cybersecurity world has been shaken by a new generation infiltration operation from Mango Sandstorm (more commonly known as MuddyWater), an Iran-backed advanced persistent threat (APT) group. This sophisticated attack campaign, codenamed Dindoor and Fakeset, specifically targeted financial institutions and defense industry companies in the United States and Israel, once again demonstrating how complex modern cyber threats have become.

The most striking aspect of this operation is its radical departure from traditional attack methods. MuddyWater has moved beyond classic malware techniques, developing an extremely difficult-to-detect, low-footprint espionage strategy by utilizing modern JavaScript runtime environments like Deno runtime and legitimate cloud services such as Wasabi and Rclone. This situation necessitates that corporate cybersecurity teams reevaluate their defense strategies.

MuddyWater: Iran's Cyber Army

MuddyWater, also known as Mango Sandstorm, SeedWorm, and TEMP.Zagros, is a cyber espionage group that has been actively operating since 2017 and is assessed to be affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC). The group specifically targets critical infrastructure, telecommunications, oil and gas, defense industry, and government institutions in the Middle East, Europe, and North America regions.

Previously known for using phishing emails, malicious Office macros, and PowerShell-based backdoors, MuddyWater has significantly evolved its tactics, techniques, and procedures (TTPs) in recent operations. This evolution demonstrates that the group continuously researches and develops innovative methods to bypass security solutions.

Technical Analysis of Dindoor and Fakeset Operations

The Dindoor and Fakeset operations represent one of the most advanced examples of modern cyber attack tactics. When we examine the technical details of this campaign, we can clearly see how sophisticated an approach the attackers have adopted.

Deno Runtime Usage: A New Attack Vector

One of the most innovative aspects of the operation is the use of the Deno JavaScript and TypeScript runtime environment. Deno is a security-focused, modern runtime environment developed by Ryan Dahl, the creator of Node.js. There are several strategic reasons behind MuddyWater's choice of this technology:

• Low detection rate: While most security solutions focus on Node.js and other popular runtime environments, Deno is not yet widely monitored.
• Legitimate appearance: Since Deno is a legitimate tool used by developers, it is less likely to be considered suspicious by system administrators and security tools.
• Powerful features: Deno offers powerful capabilities for network access, file system operations, and access to external resources.
• Permission-based model: Paradoxically, Deno's security-focused permission model allows attackers to precisely control which permissions are required.

Weaponization of Legitimate Cloud Services

Another critical component of the operation is the use of legitimate cloud storage services like Wasabi and Rclone for command-and-control (C2) infrastructure and data exfiltration. This approach is an extremely effective method for bypassing traditional security controls:

• Wasabi: Wasabi, an Amazon S3-compatible, enterprise-grade cloud storage service, is used by many businesses for legitimate purposes. Attackers upload stolen data to Wasabi buckets, concealing it within normal business traffic.
• Rclone: Rclone, a popular open-source tool that provides data synchronization between cloud storage systems, is routinely used by system administrators. MuddyWater uses this tool for data exfiltration, ensuring that network traffic appears legitimate.

The most dangerous aspect of this method is that traffic occurring over SSL/TLS encrypted connections and directed to legitimate cloud services is considered harmless by most security solutions. Traditional IP-based blocking strategies are completely ineffective against such attacks.

Target Profile and Affected Sectors

The Dindoor and Fakeset operations are directed at strategically selected targets. MuddyWater's priority target profile includes the following sectors:

• Financial Institutions: Banks, investment firms, and financial service providers are targeted both for financial gain and to obtain critical economic intelligence.
• Defense Industry: Defense contractors and technology companies are targeted to gather intelligence on military technology, weapons systems, and defense strategies.
• Technology Companies: Firms developing advanced technology are primary targets for intellectual property theft.
• Government Institutions: Government networks are infiltrated to collect diplomatic, political, and strategic intelligence.

While the geographical focus of the attacks is predominantly the US and Israel, similar operations have been observed in other Western countries. This target selection is directly related to Iran's geopolitical interests and states it considers adversaries.

Corporate Defense Strategies: IP Blocking Is No Longer Enough

MuddyWater's new generation attack techniques clearly demonstrate that traditional security approaches are no longer sufficient. Static IP address blocking, signature-based antivirus solutions, and perimeter security-focused strategies fall short against such sophisticated threats. Modern defense strategies that organizations should adopt include the following:

Monitoring Unusual Runtime Environments

Inventory and monitor all runtime environments operating on your network. Track the use of interpreters and runtime environments such as Deno, Node.js, Python, and PowerShell, and establish systems to detect unexpected or unauthorized executions. Especially on servers and critical systems, such tools