Executive Summary
The Iran-linked threat group Seedworm (also known as MuddyWater) executed an extensive espionage campaign during Q1 2026, breaching a major South Korean electronics manufacturer and various organizations across four continents. Attributed to the Iranian Ministry of Intelligence and Security (MOIS), the operation focused on gathering intellectual property and strategic intelligence from industrial manufacturing, government, and financial sectors.
Technical analysis reveals a shift toward higher operational hygiene, utilizing Node.js-based orchestrators to deliver PowerShell scripts and execute DLL sideloading. The attackers abused legitimate, signed binaries—specifically Fortemedia (fmapp.exe) and SentinelOne (sentinelmemoryscanner.exe)—to load the ChromElevator credential stealer. This maturity in tradecraft demonstrates Seedworm's evolution into more disciplined operations designed to evade standard endpoint and network-based detections.
The breadth of this campaign, reaching Southeast Asia, South Korea, and Latin America, indicates an expansion of Tehran's intelligence requirements. Organizations in the targeted sectors should prioritize hunting for the specific sideloading pairs and unauthorized Node.js execution within their environments.