MuddyWater Campaign Targeted Nine Organizations, Including an Unnamed South Korean Electronics Maker
Summary
Symantec researchers say MuddyWater spent about a week inside an unnamed South Korean electronics maker in February 2026, as part of a campaign targeting at least nine organizations. The group used DLL sideloading, PowerShell and Node.js loaders.
Key points
- Symantec attributed a campaign against at least nine organizations across multiple countries and sectors to MuddyWater, also known as Seedworm and Static Kitten.
- Researchers say the unnamed South Korean electronics manufacturer was accessed from February 20 to 27, 2026.
- The attackers sideloaded malicious DLLs through legitimate binaries, including fmapp.exe and sentinelmemoryscanner.exe; the DLLs contained the ChromElevator tool.
- PowerShell, controlled through Node.js loaders, was used for reconnaissance, screenshots, additional payloads, persistence, credential theft and SOCKS5 tunnels.
- Reported credential-theft methods included fake Windows prompts, registry hive theft and Kerberos ticket abuse tools.
- The group reportedly used sendit[.]sh, a public file-sharing service, to exfiltrate data and blend activity into normal traffic.
Article Details
- Attack Vectors
- MuddyWater used DLL sideloading with legitimate signed binaries, including fmapp.exe and sentinelmemoryscanner.exe, to load malicious DLLs.
- PowerShell, controlled through Node.js loaders, was used for screenshots, reconnaissance, additional payload downloads, persistence, credential theft, and SOCKS5 tunneling.
- Credential theft involved fake Windows prompts, registry hive theft (SAM/SECURITY/SYSTEM), and Kerberos ticket abuse tools.
- Attackers used registry modifications for persistence and relaunched sideloaded binaries to maintain access.
- Attackers used sendit.sh, a public file-sharing service, to exfiltrate data.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sendit[.]sh | Public file-sharing service used by attackers to exfiltrate data, likely to make the activity appear normal. |
MITRE ATT&CK
T1003.002 · Security Account ManagerThe attackers stole registry hives including SAM.T1056.002 · GUI Input CaptureCredential theft involved fake Windows prompts.T1059.001 · PowerShellPowerShell was used for reconnaissance, screenshots, payload downloads, persistence, credential theft, and SOCKS5 tunneling.T1090 · ProxyPowerShell was used to create SOCKS5 tunnels.T1105 · Ingress Tool TransferPowerShell was used to fetch additional payloads.T1112 · Modify RegistryRegistry modifications were used to establish persistence.T1113 · Screen CapturePowerShell was used to capture screenshots.T1518.001 · Security Software DiscoveryThe attackers enumerated antivirus software via WMI.T1567 · Exfiltration Over Web ServiceAttackers used the sendit.sh public file-sharing service for data exfiltration.T1574.002 · DLL Side-LoadingMalicious DLLs were loaded through legitimate signed binaries, including fmapp.exe and sentinelmemoryscanner.exe.
Threat Actors
MuddyWaterThe article attributes the espionage campaign targeting at least nine organizations, including a South Korean electronics manufacturer, to MuddyWater.SeedwormThe article identifies Seedworm as another name for MuddyWater and attributes the reported espionage campaign to the group.Static KittenThe article identifies Static Kitten as another name for MuddyWater and attributes the reported espionage campaign to the group.
Vendors
Tools
Countries
Industries
Electronicsagainst at least nine organizations across multiple countries and sectors, including a South Korean electronics manufacturer, government agencies, and an international airport.Governmentorganizations across multiple countries and sectors, including a South Korean electronics manufacturer, government agencies, and an international airport.