Seedworm Campaign Used DLL Sideloading in Espionage Against South Korean Electronics Maker
Summary
A technical report details a Seedworm espionage campaign targeting at least nine organizations across four continents in early 2026, including a South Korean electronics maker, using DLL sideloading, credential theft and public-service data staging.
Key points
- The report attributes the campaign to Seedworm, also known as MuddyWater, and describes activity against at least nine organizations across four continents.
- In the South Korean electronics maker intrusion, initial access is unknown; observed activity ran from February 20 to February 27, 2026.
- Attackers used Node.js to orchestrate PowerShell activity and sideload malicious DLLs through signed Fortemedia and SentinelOne executables.
- The observed toolkit included ChromElevator, screenshot capture, SAM/SECURITY/SYSTEM hive theft, a Windows credential prompt harvester and a Kerberos TGT extraction tool.
- The operators established persistence through a Windows Run registry value and repeatedly ran reconnaissance and host checks.
- In at least one intrusion, stolen data was staged through the public file-transfer service sendit[.]sh; the article also identifies timetrakr[.]cloud as a staging domain.
Article Details
- Attack Vectors
- Abused legitimately signed Fortemedia fmapp.exe and SentinelOne sentinelmemoryscanner.exe binaries to sideload malicious DLLs.
- Used Node.js scripts to orchestrate PowerShell reconnaissance, screenshot capture, and payload retrieval.
- Stole credentials by saving SAM, SECURITY, and SYSTEM registry hives and using a credential harvester that invoked the Windows credentials prompt.
- Attempted privilege escalation using a tool that extracted Kerberos TGTs through GSS-API delegation abuse.
- Established persistence through a value under the Windows CurrentVersionRun registry key.
- Used SOCKS5 reverse-proxy tunneling and staged data for exfiltration through a public file-transfer service.
- Defensive Notes
- The article says Symantec Endpoint products will detect and block listed malicious files when an IOC is malicious and the file is available.
- Monitor for signed executable and malicious DLL pairs, especially when launched through node.exe, and for PowerShell activity involving reconnaissance or downloads from staging infrastructure.
- Review unexpected CurrentVersionRun registry values, registry hive saves, credential-prompt harvesting, and SOCKS5 tunneling activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | timetrakr[.]cloud | Described as an attacker-owned staging domain used to deliver a PowerShell script. |
| IPV4 | 104[.]21[.]48[.]205 | Listed as attacker staging or related network infrastructure in the campaign's network IOCs. |
| IPV4 | 172[.]67[.]156[.]47 | Listed as attacker staging or related network infrastructure in the campaign's network IOCs. |
| IPV4 | 178[.]128[.]233[.]36 | Listed as attacker staging or related network infrastructure in the campaign's network IOCs. |
| IPV4 | 179[.]43[.]177[.]220 | Attacker-controlled staging server used to deliver PowerShell and other payloads. |
| IPV4 | 34[.]117[.]59[.]81 | Listed as attacker staging or related network infrastructure in the campaign's network IOCs. |
| IPV4 | 37[.]187[.]78[.]41 | Listed as attacker staging or related network infrastructure in the campaign's network IOCs. |
| SHA256 | 0c9b911935a3705b0ad569446804d80026feb6db3884aeb240b6c76e9b8cf139 | Hash listed for sentinelagentcore.dll, a malicious DLL used in the sideloading activity. |
| SHA256 | 3ee7dab4ae4f6d4f16dfabb6f38faef370411a9fc00ff035844e54703b99600a | Hash listed for a SAM-hive credential extractor used in the campaign. |
| SHA256 | 74ab3838ebed7054b2254bf7d334c80c8b2cfec4a97d1706723f8ea55f11061f | Hash of the privilege-escalation tool used for Kerberos TGT extraction. |
| SHA256 | b21c802775df0c0d82c8cfde299084abc624898b10258db641b820172a0ba29a | Hash listed for a SOCKS5 proxy tool used in the campaign. |
| SHA256 | bee79c3302b1a7afc0952842d14eff83a604ef00bfdae525176c16c80b2045f7 | Hash listed for a SAM-hive credential extractor used in the campaign. |
| SHA256 | c6182fd01b14d84723e3c9d11bc0e16b34de6607ccb8334fc9bb97c1b44f0cde | Hash listed for fmapp.dll, a malicious DLL used in the sideloading activity. |
| SHA256 | d587959841a763669279ad831b8f0379f6a7b037dffc19deab5d41f37f8b5ffc | Hash of a credential harvester that invokes the Windows credentials prompt and saves the entered password. |
| URL | hxxp[:]//179[.]43[.]177[.]220:8080/a.dat | Attacker-controlled staging URL used to download a file believed to be an encoded payload. |
| URL | hxxp[:]//179[.]43[.]177[.]220:8080/a.exe | Attacker-controlled staging URL used to download a Windows executable. |
| URL | hxxp[:]//179[.]43[.]177[.]220:8080/nm.ps1 | Attacker-controlled staging URL used to retrieve a PowerShell payload. |
| URL | hxxps[:]//timetrakr[.]cloud/sp.ps1 | Attacker-owned staging URL used to retrieve a PowerShell script. |
MITRE ATT&CK
T1003.002 · Security Account ManagerThe attackers saved the SAM hive for offline hash extraction.T1003.004 · LSA SecretsThe attackers saved the SECURITY hive for extraction of cached secrets and credentials.T1056.002 · GUI Input CaptureA credential harvester invoked CredUIPromptForWindowsCredentialsW to capture entered credentials.T1059.001 · PowerShellPowerShell was used for reconnaissance, screenshots, payload retrieval, and repeated host checks.T1059.006 · PythonNode.js scripts orchestrated multiple intrusion stages and the loader chain.T1068 · Exploitation for Privilege EscalationA privilege-escalation tool attempted to obtain elevated access through Kerberos/GSS-API delegation abuse.T1082 · System Information DiscoveryCommands including hostname and ipconfig /all gathered host and network information.T1087.002 · Domain AccountCommands including net user /domain and net group enumerated domain accounts and groups.T1090.001 · Internal ProxyA sideloaded DLL provided SOCKS5 reverse-proxy tunneling through the victim host.T1105 · Ingress Tool TransferThe attackers downloaded PowerShell scripts and other payloads from staging infrastructure.T1119 · Automated CollectionScripts appear to have captured screenshots of the victim's primary display.T1518.001 · Security Software DiscoveryWMI enumerated antivirus products registered with Windows Security Center.T1547.001 · Registry Run Keys / Startup FolderThe attackers added a value to the CurrentVersionRun registry key to relaunch the loader at user logon.T1550.003 · Pass the TicketThe privilege-escalation tool attempted to obtain a usable TGT from a high-privilege user.T1574.002 · DLL Side-LoadingSeedworm used signed Fortemedia and SentinelOne executables to load malicious DLLs.
Threat Actors
MuddyWaterThe article identifies MuddyWater as another name for Seedworm, which it attributes with the reported espionage campaign.SeedwormThe article attributes the espionage campaign, including intrusions against a South Korean electronics manufacturer and other organizations, to Seedworm; it says the group is widely believed to be linked to Iran's Ministry of Intelligence and Security.Static KittenThe article identifies Static Kitten as another name for Seedworm, which it attributes with the reported espionage campaign.Temp ZagrosThe article identifies Temp Zagros as another name for Seedworm, which it attributes with the reported espionage campaign.
Vendors
Products
Node.jsSeedworm targeted at least nine organizations across four continents in early 2026, using signed DLL sideloading, Node.js-orchestrated PowerShell, and multiple credential theft tools to support espionage operations.PowerShellSeedworm targeted at least nine organizations across four continents in early 2026, using signed DLL sideloading, Node.js-orchestrated PowerShell, and multiple credential theft tools to support espionage operations.SentinelOne#Seedworm
Tools
Countries
Industries
EducationAt least nine organizations in nine countries across four continents were affected, spanning industry, public sector, finance, and education.Electronics manufacturingat least nine organizations across nine countries on four continents, spanning industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services.Financial Servicescontinents, spanning industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services.Governmentrepeatedly focusing on intelligence-rich victims including a South Korean electronics manufacturer, government agencies, and financial and educational institutions.Professional Servicesand electronics manufacturing, education and public-sector bodies, financial services, and professional services.