Threat Hunter Team Reports Seedworm Campaign and New Dindoor Backdoor
Summary
The Threat Hunter Team reports increased Seedworm activity since early February 2026 against U.S. and Canadian organizations, including entities tied to Israel, and says researchers found the previously undocumented Dindoor backdoor on several networks.
Key points
- The Threat Hunter Team reports increased activity by Iranian-linked Seedworm, also known as MuddyWater, since early February 2026.
- The report describes suspicious network activity at a U.S. bank, a defense-aerospace supplier’s software subsidiary, an airport, and NGOs in the U.S. and Canada.
- Researchers say they found the previously undocumented Dindoor backdoor on several target networks; the article provides no technical details about its operation.
- The report says Handala has used partial data leaks and claims to intimidate targets and amplify pressure.
- Defenders are urged to hunt for Dindoor indicators and harden public-facing logistics and supply-chain interfaces.
Article Details
- Event Type
- Reported cyberespionage activity and deployment of the previously undocumented Dindoor backdoor, alongside hacktivist data leaks.
- Impact
- The report says multiple U.S. organizations and companies, as well as NGOs in the U.S. and Canada, experienced suspicious network activity beginning in early February 2026. Reported victims include a U.S. bank, an airport, and a software subsidiary serving the defense and aerospace industries; activity appeared focused on the supplier’s Israeli outpost. The backdoor was identified on several targets. Handala’s partial data leaks were reported as a means of intimidating targets and amplifying the intrusions.
Threat Actors
HandalaThe report describes Handala as a hacktivist group that has used partial data leaks to intimidate targets and amplify intrusions.MuddyWaterThe article identifies MuddyWater as another name for Seedworm, which the report links to the described cyberespionage activity.SeedwormThe report attributes increased cyberespionage and intrusions into multiple organizations to Iranian-linked Seedworm.Static KittenThe article identifies Static Kitten as another name for Seedworm, which the report links to the described cyberespionage activity.
Malware
Countries
Industries
Aerospacebank, a defenseâaerospace supplier’s software subsidiary, an airport, and NGOs in the U.S.Defensewhile hacktivist group Handala has used partial data leaks to amplify attacks, elevating the threat to defense suppliers and critical national infrastructure.Non-governmental organizationsbank, software company and airport, and non-governmental organizations in both the U.S.