# Iranian Hackers Escalate Espionage Campaign with Sophisticated DLL Side-Loading Across Nine Countries


The Iranian threat group MuddyWater has conducted a sprawling espionage campaign targeting at least nine organizations across nine countries on four continents during the first quarter of 2026, according to analysis from Symantec's Threat Hunter Team and Carbon Black. The campaign demonstrates a marked evolution in operational discipline and sophistication, employing legitimate software binaries to hide malicious code and employing a multi-stage infection chain designed to evade detection.


## The Campaign


Between January and March 2026, MuddyWater successfully compromised organizations across diverse sectors and geographies. Confirmed targets include:


  • A major South Korean electronics manufacturer — where attackers maintained network presence for at least one week in February 2026
  • An international airport in the Middle East
  • Industrial manufacturers across Southeast Asia
  • A financial-services provider in Latin America
  • Additional organizations in education, public sector, and professional services sectors

    • The breadth of the campaign underscores MuddyWater's operational reach and resource capacity. While the initial access vector remains unknown in most cases, evidence suggests the group spent considerable time conducting reconnaissance and credential harvesting before exfiltrating sensitive data.


    ## Technical Details: DLL Side-Loading and ChromElevator


    The technical cornerstone of this campaign centers on DLL side-loading, a technique that exploits how Windows resolves dependencies for legitimate executables. Rather than developing custom malware from scratch, MuddyWater weaponized two legitimate, digitally signed binaries:


    ### Compromised Binaries


    | Binary | Legitimate Source | Malicious DLL | Purpose |

    |--------|-------------------|----------------|---------|

    | fmapp.exe | Fortemedia | fmapp.dll | Generic payload delivery |

    | sentinelmemoryscanner.exe | SentinelOne | sentinelagentcore.dll | Signature-based detection evasion |


    The choice to abuse SentinelOne's binary was deliberate—security researchers assess that the attackers selected this specific binary because it's designed to run with elevated privileges and carry security-related responsibilities, making it less likely to trigger behavioral detection rules.


    When executed, both DLLs embed ChromElevator, an open-source tool specifically engineered to extract sensitive data from Chromium-based browsers (Google Chrome, Microsoft Edge, Brave, etc.). This tool proves particularly potent because it circumvents App-Bound Encryption (ABE), a Windows security feature designed to protect browser-stored credentials and payment card information from local extraction. With ABE bypassed, attackers gained access to:


  • Saved passwords across multiple websites and services
  • Session cookies enabling account hijacking without credentials
  • Payment card data stored in autofill fields
  • Authentication tokens for web applications

    • ### Multi-Stage Infection Chain


    The complete attack sequence unfolds as follows:


    1. Initial Compromise — Unknown initial access vector (possibly phishing, credential compromise, or unpatched vulnerability)

    2. Node.js Implant Deployment — A Node.js-based backdoor is deployed to the compromised system

    3. PowerShell Reconnaissance — Node.js executes PowerShell scripts that perform:

    - System discovery and network enumeration

    - Screenshot capture for situational awareness

    - SAM (Security Account Manager) hive theft for local credential extraction

    - Privilege escalation attempts

    - SOCKS5 reverse-proxy tunneling for persistent access

    4. Browser Credential Theft — DLL side-loading pairs are executed to deploy ChromElevator

    5. Lateral Movement — Harvested credentials enable movement throughout the network

    6. Data Exfiltration — Stolen data is staged on sendit[.]sh, a public file-transfer service offering temporary hosting


    The use of Node.js as a backdoor is itself notable—it's a legitimate runtime environment commonly installed on development systems, making its presence less suspicious during forensic examination than traditional malware.


    ## Background and Context: MuddyWater's Evolution


    MuddyWater, also known as Seedworm, is an Iranian state-aligned threat group believed to operate under the Iranian Islamic Revolutionary Guard Corps (IRGC) cyber warfare apparatus. The group has been active since at least 2015, conducting espionage operations primarily against Middle Eastern and Western targets.


    What distinguishes this 2026 campaign is not the novelty of individual techniques—security researchers emphasized that "none of these techniques is individually novel"—but rather their combination and execution discipline. Researchers observe that MuddyWater has undergone significant operational maturation:


  • From noisy to quiet: Earlier MuddyWater campaigns relied on continuous operator presence and high-velocity tool deployment. This campaign shows a shift toward implant-driven activity with longer dwell times and more careful reconnaissance.
  • Improved operational hygiene: The group no longer relies solely on known public exploits or publicly available tools. The sophisticated staging on public file-transfer services and the careful selection of legitimate binaries for side-loading suggest a more deliberate approach.
  • Supply-chain awareness: The deliberate choice to abuse a security vendor's legitimate binary demonstrates that MuddyWater monitors and understands the defensive tools deployed by target organizations.

    • The timing of this campaign coincides with broader Iranian cyber operations. In late May 2026, the European Council imposed sanctions on Emennet Pasargad (also known as Shahid Shushtari), an Iranian company affiliated with the IRGC-CEC, for conducting hacking operations against Swedish SMS infrastructure and a French telecommunications subscriber database. The same entity is tracked under the threat intelligence monikers Cobalt Obelisk and Cotton Sandstorm.


    ## Implications for Organizations


    This campaign carries several critical implications:


    ### Widespread Vulnerability to Lateral Movement

    Organizations cannot assume that compromised user credentials are isolated threats. With the ability to extract browser-stored credentials and session cookies, attackers can move laterally from a single compromised workstation to critical infrastructure, cloud accounts, and external partner systems.


    ### Browser-Stored Secrets Are High-Value Targets

    Many organizations implement strong password management policies but fail to recognize that browsers themselves function as credential repositories. App-Bound Encryption is only effective if operating system patching is current and local administrators are not compromised.


    ### Legitimate Tools Are Now Attack Vectors

    The security software supply chain represents a significant attack surface. Organizations cannot assume that installing security tools provides protection if those tools' binaries can be abused for sideloading attacks.


    ### Detection Is Difficult Without Visibility

    The use of legitimate, signed binaries and public infrastructure (Node.js, sendit.sh) means traditional signature-based detection will fail. Effective detection requires behavioral monitoring, memory analysis, and network telemetry.


    ## Recommendations


    For Security Teams:


  • Implement application whitelisting policies that restrict which binaries can execute DLLs from non-standard locations
  • Monitor for DLL side-loading indicators: Alert on instances where legitimate binaries load DLLs from directories other than their standard installation paths
  • Enable Browser Credential Protection: On Windows systems, verify that App-Bound Encryption is enforced and that endpoint protection prevents unauthorized access to credential stores
  • Conduct credential audit: Assume any system with network access over the past 3-6 months may have credentials exposed. Rotate high-value credentials including domain admin, cloud platform, and VPN accounts
  • Review file-transfer service access: Block or monitor access to services like sendit.sh, filemail, and similar temporary file-sharing platforms used for exfiltration

    • For Organizations in High-Risk Sectors:


  • Industrial and Electronics Manufacturing: Implement network segmentation between engineering networks and corporate infrastructure. Assume Nation-state threat actors are actively targeting your design files and intellectual property
  • Financial Services: Strengthen external-facing authentication with hardware security keys, reduce reliance on password-based authentication, and implement transaction monitoring
  • Education and Public Sector: Review access controls for administrative accounts. State-sponsored actors prioritize public sector networks for long-term persistence and intelligence gathering

    • For All Organizations:


  • Review logs for Node.js process execution, particularly instances spawning PowerShell
  • Audit browser credential stores for unauthorized access patterns
  • Conduct incident response tabletop exercises focused on multi-stage attacks involving legitimate tools
  • Maintain 90-day credential rotation policies for any accounts with cross-system or cross-cloud access

    • ---


    ## HackWire Analysis


    This campaign represents a meaningful inflection point in Iranian cyber capabilities. What's most striking isn't the individual techniques—DLL side-loading has been documented for years, ChromElevator is publicly available, and PowerShell reconnaissance is table-stakes for any network intrusion. What matters is the *combination* and the discipline.


    MuddyWater is behaving less like a threat actor with unlimited resources and more like a professional penetration testing firm with constraints. The group spent a week in the South Korean manufacturer's network rather than weeks. They staged data on public services rather than maintaining dedicated infrastructure. They re-executed sideloaded binaries to maintain access rather than deploying newer implants. This isn't sloppiness—it's tradecraft.


    The sanctions on Emennet Pasargad provide a crucial data point: this activity is almost certainly coordinated with Iran's broader cyber operations. The timing of sanctions against the SMS infrastructure attacker and the concurrent emergence of this more sophisticated espionage campaign suggests we're seeing different teams within Iran's cyber apparatus executing parallel operations—one conducting disruptive attacks on critical infrastructure, the other conducting long-term IP theft and intelligence gathering.


    For defenders, this means the threat model has shifted. You're no longer primarily defending against script-kiddies or financially-motivated cybercriminals. You're defending against resourced, patient adversaries with strategic objectives and operational discipline. DLL side-loading detection requires EDR tools that understand Windows binary behavior, not just antivirus signatures. Credential protection requires assuming browser storage is compromised. Network segmentation requires assuming lateral movement will be attempted.


    The most alarming finding: the initial access vector is still unknown. That means organizations can't identify *how* the attackers got in. They simply know they were there. For the organizations targeted—particularly the South Korean manufacturer—that's a wake-up call that their perimeter detection failed to surface the compromise quickly enough.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Cyber Espionage](https://www.hackwire.news/category/cyber-espionage) coverage
  • Cross-reference with [Threat Intelligence](https://www.hackwire.news/category/threat-intelligence) and [Nation-State Threats](https://www.hackwire.news/category/nation-state-threats)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)