MuddyWater Campaign Used DLL Side-Loading and ChromElevator to Steal Browser Data
Summary
Researchers linked MuddyWater to a Q1 2026 espionage campaign targeting at least nine organizations, using DLL side-loading, Node.js and PowerShell to steal browser data and credentials. Separate Iran-linked operations used FileFiend and other exfiltration methods.
Key points
- Researchers linked MuddyWater to a Q1 2026 campaign affecting at least nine organizations across nine countries; the initial access method is unknown.
- The attackers used signed Fortemedia and SentinelOne binaries to sideload malicious DLLs.
- The DLLs embedded ChromElevator to steal passwords, cookies and payment card data from Chromium browsers, bypassing App-Bound Encryption protections.
- A Node.js implant chain launched PowerShell for reconnaissance, screenshots, SAM hive theft, privilege escalation and SOCKS5 tunneling.
- In the South Korean manufacturer intrusion, researchers said attackers spent a week inside the network and repeatedly ran reconnaissance; the article says they are believed to have re-executed binaries to retain access.
- Gambit Security linked infrastructure used in a separate Iran-backed campaign to MOIS and described FileFiend, a C++ tool for collecting files from local drives and SMB shares.
- In that campaign, data was also reportedly archived on victim hosts and uploaded to public websites, then retrieved using Axel and tunneled through proxychains.
Article Details
- Attack Vectors
- MuddyWater used DLL side-loading with signed Fortemedia (fmapp.exe) and SentinelOne (sentinelmemoryscanner.exe) binaries to execute malicious DLLs.
- The side-loaded DLLs contained ChromElevator, which stole passwords, cookies, and payment card data from Chromium-based browsers.
- Node.js scripts launched PowerShell for reconnaissance, screenshot capture, and other information gathering.
- The reported intrusion activity included SAM hive theft, credential dumping, privilege escalation, and SOCKS5 reverse-proxy tunneling.
- FileFiend could enumerate local drives and SMB shares, collect files, and send them to a hard-coded C2 server.
- In another reported exfiltration method, data was compressed into RAR archives on a host in the victim environment, uploaded to the victim organization’s public website, then retrieved using Axel and tunneled through proxychains.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 157[.]20[.]182[.]49 | Attacker-controlled IP address that the fmapp.dll payload was reported to connect to. |
MITRE ATT&CK
T1003.002 · Security Account ManagerThe reported implant chain performed SAM hive theft.T1005 · Data from Local SystemFileFiend collected files from local drives and the victim file system.T1039 · Data from Network Shared DriveFileFiend could enumerate SMB shares and collect files from them.T1041 · Exfiltration Over C2 ChannelFileFiend could send collected files to a hard-coded C2 server.T1059.001 · PowerShellPowerShell scripts performed reconnaissance and information gathering, among other activities.T1083 · File and Directory DiscoveryFileFiend could enumerate local drives and walk the file system.T1090 · ProxyThe implant chain used SOCKS5 reverse-proxy tunneling.T1113 · Screen CaptureThe PowerShell activity included capturing screenshots.T1135 · Network Share DiscoveryFileFiend could enumerate SMB shares.T1539 · Steal Web Session CookieChromElevator was used to steal browser cookies.T1555.003 · Credentials from Web BrowsersChromElevator was used to steal passwords from Chromium-based browsers.T1560.001 · Archive via UtilityIn a reported exfiltration method, data was compressed into RAR archives on a host inside the victim environment.T1574.002 · DLL Side-LoadingMuddyWater reportedly used signed Fortemedia and SentinelOne binaries to side-load malicious DLLs.
People
Threat Actors
Ababil of MinabA pro-Iranian persona claimed the exfiltration and destructive operations; the claim does not establish responsibility, and Gambit Security instead tied the campaign infrastructure to MOIS.ChaoticOrchestraIdentified in the article as the former name of Haywire Kitten, a tracking moniker for Emennet Pasargad.Cobalt ObeliskListed as a tracking moniker for Emennet Pasargad, also identified as Shahid Shushtari.Cotton SandstormListed as a tracking moniker for Emennet Pasargad, also identified as Shahid Shushtari.Emennet PasargadThe European Council imposed sanctions on the company for reported hacking of a Swedish SMS service, access to a French subscriber database, and disinformation activity involving compromised advertising billboards.Haywire KittenListed as a tracking moniker for Emennet Pasargad, also identified as Shahid Shushtari.MarnanbridgeListed as a tracking moniker for Emennet Pasargad, also identified as Shahid Shushtari.MOISGambit Security reportedly tied infrastructure used in the exfiltration campaign to Iran’s Ministry of Intelligence and Security.MuddyWaterLinked by researchers to a 2026 espionage campaign involving DLL side-loading, credential theft, and activity across organizations in nine countries.Shahid ShushtariIdentified by the U.S. State Department as another name for Emennet Pasargad; reported campaigns caused financial damage and disruption to U.S. businesses and government agencies.UNC5866Listed as a tracking moniker for Emennet Pasargad, also identified as Shahid Shushtari.
Vendors
Products
App-Bound EncryptionBoth the DLLs embed an open-source tool called ChromElevator to siphon passwords, cookies, and payment card data from Chromium-based browsers, effectively getting around App-Bound Encryption (ABE) protections.ChromiumChromElevator was used to steal passwords, cookies, and payment card data from Chromium browsers.Node.jsMuddyWater is linked to a broad 2026 espionage campaign that hit at least nine organizations across nine countries, using DLL side-loading, Node.js, PowerShell, and ChromElevator to steal credentials and browser data.PowerShellMuddyWater is linked to a broad 2026 espionage campaign that hit at least nine organizations across nine countries, using DLL side-loading, Node.js, PowerShell, and ChromElevator to steal credentials and browser data.
Tools
Axeland uploaded to the organization’s public website at the web root, from where they are extracted using the Axel command-line download accelerator and tunneled through proxychains.ChromElevatorMuddyWater is linked to a broad 2026 espionage campaign that hit at least nine organizations across nine countries, using DLL side-loading, Node.js, PowerShell, and ChromElevator to steal credentials and browser data.FileFiendIn these cases, the adversary has been found to employ a bespoke C++ file collection and exfiltration tool internally codenamed FileFiend.proxychainsfrom where they are extracted using the Axel command-line download accelerator and tunneled through proxychains.
Countries
IsraelSeparately, Iran-linked operations tied to Emennet Pasargad, Shahid Shushtari, and MOIS targeted organizations in the U.S., Israel, Saudi Arabia, Turkey, and beyond with exfiltration and disruptive activity.Saudi ArabiaSeparately, Iran-linked operations tied to Emennet Pasargad, Shahid Shushtari, and MOIS targeted organizations in the U.S., Israel, Saudi Arabia, Turkey, and beyond with exfiltration and disruptive activity.TurkeySeparately, Iran-linked operations tied to Emennet Pasargad, Shahid Shushtari, and MOIS targeted organizations in the U.S., Israel, Saudi Arabia, Turkey, and beyond with exfiltration and disruptive activity.United StatesSeparately, Iran-linked operations tied to Emennet Pasargad, Shahid Shushtari, and MOIS targeted organizations in the U.S., Israel, Saudi Arabia, Turkey, and beyond with exfiltration and disruptive activity.
Industries
EducationThe activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.Electronics manufacturingThe activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.Energy“These campaigns have targeted multiple critical infrastructure sectors, including news, shipping, travel, energy, financial, and telecommunications in the United States, Europe, and the Middle East.”Financial ServicesThe activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.MediaOther targets include an Israeli organization in the media sector, an Israeli higher education institution, a Turkish insurance brokerage, and several additional websites across the restaurant, culture, digitalProfessional ServicesThe activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.Telecommunications“These campaigns have targeted multiple critical infrastructure sectors, including news, shipping, travel, energy, financial, and telecommunications in the United States, Europe, and the Middle East.”Travel“These campaigns have targeted multiple critical infrastructure sectors, including news, shipping, travel, energy, financial, and telecommunications in the United States, Europe, and the Middle East.”