Seedworm Activity Found Across U.S. and Canadian Organizations as New Backdoors Emerge
Summary
A report links activity since February 2026 at U.S. and Canadian organizations to Seedworm, citing Dindoor and Fakeset backdoors and an attempted Rclone transfer to Wasabi whose success is unknown. It recommends stronger credential and exfiltration monitoring.
Key points
- The article reports suspicious activity on networks involving a U.S. bank, airport, software company’s Israeli operation, and Canadian nonprofit, beginning in February 2026.
- Researchers found the previously unknown Dindoor backdoor, which uses the Deno runtime, on the software company’s Israeli operation, a U.S. bank, and the Canadian nonprofit.
- The Python-based Fakeset backdoor was found on the U.S. airport’s and a nonprofit’s networks. Its code-signing certificates and links to other tools are cited as evidence connecting the activity to Seedworm.
- An attempted Rclone transfer from the software company to a Wasabi cloud bucket was observed; the article says it is unclear whether the transfer succeeded.
- The report says related Stagecomp and Darkcomp malware was not found on the targeted networks, but certificate reuse suggests a connection to the same actor.
- Recommended defenses include monitoring for password spraying, unusual outbound transfers and Rclone use; enforcing MFA, patching exposed services, and isolating backups.
Article Details
- Event Type
- Reported Iranian cyber-espionage activity attributed to Seedworm, involving intrusions on multiple U.S., Israeli, and Canadian networks and deployment of previously unknown backdoors.
- Impact
- A U.S. bank, airport, a Canadian nonprofit, and the Israeli operation of a U.S. software company were affected by suspicious network activity. Dindoor and Fakeset backdoors were found on victim networks, and an attempt to exfiltrate data from the software company to Wasabi cloud storage was observed; whether that transfer succeeded is unknown. The activity raises concern about potential follow-on attacks, but the article does not report destructive impact from these intrusions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | moonzonet[.]com | Listed as a hosting or distribution domain associated with the reported threat activity. |
| DOMAIN | serialmenot[.]com | Listed as a hosting or distribution domain associated with the reported threat activity. |
| DOMAIN | uppdatefile[.]com | Listed as a hosting or distribution domain associated with the reported threat activity. |
| HOSTNAME | elvenforest[.]s3[.]us-east-005[.]backblazeb2[.]com | Backblaze-hosted endpoint from which the Fakeset backdoor was downloaded. |
| HOSTNAME | gitempire[.]s3[.]us-east-005[.]backblazeb2[.]com | Backblaze-hosted endpoint from which the Fakeset backdoor was downloaded. |
| SHA256 | 077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de | Trojan.Fakeset malware sample found on victim networks. |
| SHA256 | 0f9cf1cf8d641562053ce533aaa413754db88e60404cab6bbaa11f2b2491d542 | Trojan.Dindoor malware sample observed on victim networks. |
| SHA256 | 1319d474d19eb386841732c728acf0c5fe64aa135101c6ceee1bd0369ecf97b6 | Trojan.Darkcomp malware sample linked to Seedworm. |
| SHA256 | 15061036c702ad92b56b35e42cf5dc334597e7311e98d2fdd3815a69ac3b1d84 | Trojan.Fakeset malware sample found on victim networks. |
| SHA256 | 1d984d4b2b508b56a77c9a567fb7a50c858e672d56e8cf7677a1fca5c98c95d1 | Trojan.Dindoor malware sample. |
| SHA256 | 24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14 | Trojan.Stagecomp malware sample linked to Seedworm. |
| SHA256 | 2a00705cfd3c15cf8913e9eb4e23968efd06f1feceaef9987d26c5518887d043 | Trojan.Dindoor malware sample. |
| SHA256 | 2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5 | Trojan.Dindoor malware sample. |
| SHA256 | 2b7d8a519f44d3105e9fde2770c75efb933994c658855dca7d48c8b4897f81e6 | Trojan.Fakeset malware sample. |
| SHA256 | 3df9dcc45d2a3b1f639e40d47eceeafb229f6d9e7f0adcd8f1731af1563ffb90 | Trojan.Darkcomp malware sample linked to Seedworm. |
| SHA256 | 42a5db2a020155b2adb77c00cbe6c6ad27c2285d8c6114679d9d34137e870b3f | Trojan.Dindoor malware sample. |
| SHA256 | 4aef998e3b3f6ca21c78ed71732c9d2bdcc8a4e0284f51d7462c79d446fbc7be | Trojan.Fakeset malware sample. |
| SHA256 | 64263640a6fdeb2388bca2e9094a17065308cf8dcb0032454c0a71d9b78327eb | Trojan.Fakeset malware sample. |
| SHA256 | 64cf334716f15da1db7981fad6c81a640d94aa1d65391ef879f4b7b6edf6e7f1 | Trojan.Fakeset malware sample. |
| SHA256 | 7467f326677a4a2c8576e71a832e297e794ea00e9b67c4fcbe78b5aec697cec4 | Trojan.Dindoor malware sample. |
| SHA256 | 74db1f653da6de134bdc526412a517a30b6856de9c3e5d0c742cb5fe9959ad0d | Trojan.Fakeset malware sample. |
| SHA256 | 7c30c16e7a311dc0cdb1cdfd9ea6e502f44c027328dbe7d960b9bcd85ccf5eef | Trojan.Dindoor malware sample. |
| SHA256 | 94f05495eb1b2ebe592481e01d3900615040aa02bd1807b705a50e45d7c53444 | Trojan.Fakeset malware sample. |
| SHA256 | a4bd1371fe644d7e6898045cc8e7b5e1562bdfd0e4871d46034e29a22dec6377 | Trojan.Fakeset malware sample. |
| SHA256 | a5d4d6be3bfe0cba23fe6b44984b5fc9c7c7e10030be96120bb30da0f2545d4c | Trojan.Fakeset malware sample. |
| SHA256 | a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0 | Trojan.Stagecomp malware sample linked to Seedworm. |
| SHA256 | b0af82de672d81f3c2f153977923b3884a8a9e7045b182c2379b19a1996931a0 | Trojan.Dindoor malware sample. |
| SHA256 | bd8203ab88983bc081545ff325f39e9c5cd5eb6a99d04ae2a6cf862535c9829a | Trojan.Dindoor malware sample. |
| SHA256 | c7cf1575336e78946f4fe4b0e7416b6ebe6813a1a040c54fb6ad82e72673478e | Trojan.Dindoor malware sample. |
| SHA256 | ddceade244c636435f2444cd4c4d3dc161981f3af1f622c03442747ecef50888 | Trojan.Fakeset malware sample. |
MITRE ATT&CK
T1078 · Valid AccountsThe article describes compromised mailboxes and credential compromise as means of access and backdoor distribution.T1110.003 · Password SprayingPassword-spraying attacks were reported against Israeli municipal government entities.T1190 · Exploit Public-Facing ApplicationMarshtreader was reported scanning for vulnerable cameras using CVE-2023-6895 and CVE-2017-7921.T1219 · Remote Access ToolsPDQ was reportedly hosted on a C2 server for remote access and persistence; AnyDesk and ScreenConnect were also used in described operations.T1485 · Data DestructionWiper operations described in the article destroyed data; BibiWiper encrypted files, overwrote the MBR, and crashed the computer.T1499 · Endpoint Denial of ServiceDieNet and other actors reportedly used high-volume DDoS methods, including TCP RST, DNS amplification, TCP SYN floods, and NTP amplification.T1553 · Subvert Trust ControlsDindoor and Fakeset samples were signed using certificates issued to named individuals, indicating abuse of code-signing trust.T1566.001 · Spearphishing AttachmentA malicious Office attachment was used to deliver the Phoenix backdoor in a reported Seedworm spear-phishing campaign.T1566.003 · Spearphishing via ServiceA compromised mailbox was used to distribute the Phoenix backdoor.T1567.002 · Exfiltration to Cloud StorageRclone was used in an attempted transfer of backups to a Wasabi cloud storage bucket; success was not confirmed.T1595.002 · Vulnerability ScanningScanning of exposed targets and API endpoints was reported as reconnaissance activity.
CVE
CVE-2017-7921Hikvision · Ds-2cd2032-i firmware; Hikvision · Ds-2cd2112-i firmware; +56 moreusing known CVEs to gather intelligence: (‘scanning for vulnerable cameras using CVE-2023-6895 and CVE-2017-7921’).CVE-2023-6895Hikvision · Intercom Broadcasting Systemwas performed using known CVEs to gather intelligence: (‘scanning for vulnerable cameras using CVE-2023-6895 and CVE-2017-7921’).
People
Benjamin NetanyahuHandala posted messages claiming he would be its next target.Naftali BennettHandala claimed in December 2025 to have compromised his mobile device; researchers disputed the extent of access and said activity appeared limited to Telegram accounts.Suzanne MaloneyHer name was impersonated in reported Seedworm spear-phishing emails targeting academics and foreign-policy experts.Tzachi BravermanHandala claimed in December 2025 to have compromised his mobile device; researchers disputed the extent of access and said activity appeared limited to Telegram accounts.
Threat Actors
Agonizing SerpensThe article identifies Agonizing Serpens as an alternate name for Marshtreader, which was reported scanning for vulnerable cameras across Israel.AgriusThe article identifies Agrius as an alternate name for Marshtreader, which was reported scanning for vulnerable cameras across Israel.APT-C-23The article identifies APT-C-23 as an alternate name for Mantis, whose reported activity includes espionage operations.Arid ViperThe article identifies Arid Viper as an alternate name for Mantis, whose reported activity includes espionage operations.Charming KittenThe article identifies Charming Kitten as an alternate name for Damselfly, which it describes as an Iranian espionage group.DamselflyAn Iranian espionage group linked by multiple vendors to the IRGC; the article describes credential theft, phishing, and intelligence-gathering activity attributed to the group.Desert FalconThe article identifies Desert Falcon as an alternate name for Mantis, whose reported activity includes espionage operations.DieNetA pro-Palestinian hacktivist group that claimed responsibility for DDoS attacks against U.S. critical infrastructure and also conducted defacements and data breaches.DruidflyAn Iranian attack group linked in the article to wiper operations against Albania and Israel. The FBI later established that Iranian state cyber actors were responsible for attacks claimed by Homeland Justice.HandalaAn Iranian-aligned hacktivist group that has claimed breaches, data theft, phishing, extortion, and destructive attacks against Israeli organizations and other targets. Some breach claims are disputed or may be exaggerated.Homeland JusticeThe article identifies Homeland Justice as an alternate name associated with Druidfly; the group claimed credit for attacks in Albania, while the FBI later attributed responsibility to Iranian state cyber actors.KarmaThe article identifies Karma as an alternate name associated with Druidfly and describes it as a persona used in wiper attacks against Israeli targets.MantisAn Arabic-speaking group described as conducting espionage against government, military, media, financial, research, education, and energy targets. The article notes that it cannot definitively attribute the group to a Palestinian organization.MarshtreaderA group reportedly linked to Iran’s MOIS; it was reported scanning for vulnerable cameras across Israel in June 2025.Mint SandstormThe article identifies Mint Sandstorm as an alternate name for Damselfly, which it describes as an Iranian espionage group.MuddyWaterThe article identifies MuddyWater as an alias of Seedworm, which it attributes to the reported intrusions on U.S., Israeli, and Canadian networks.Pink SandstormThe article identifies Pink Sandstorm as an alternate name for Marshtreader, which was reported scanning for vulnerable cameras across Israel.SeedwormThe article attributes recent intrusions on U.S., Israeli, and Canadian networks to Seedworm. Shared certificate use links the activity to Seedworm-associated Stagecomp and Darkcomp, though the article describes the same-actor conclusion as suggested rather than certain.Static KittenThe article identifies Static Kitten as an alias of Seedworm, which it attributes to the reported intrusions on U.S., Israeli, and Canadian networks.
Malware
AridGopherMantis uses custom malware and its most recent toolset includes the backdoors Trojan.Micropsia and Trojan.AridGopher.BibiWiper– Wiper malware has been used in destructive operations historically and in recent attacks (e.g., BibiWiper, Shamoon): (‘wiper encrypted files on the hard disk before overwriting the master boot record (MBR) andDarkcompCherne” and “Donald Gay”), hosting on Backblaze S3 endpoints, and links to previously observed Stagecomp/Darkcomp activity, indicating a coordinated Iranian espionage campaign with potential for disruptive follow-onDinDoorcorporate and NGO networks since February 2026, deploying novel backdoors (Dindoor using Deno, and Python-based Fakeset) and attempting exfiltration via Rclone to cloud storage.Fakesetcorporate and NGO networks since February 2026, deploying novel backdoors (Dindoor using Deno, and Python-based Fakeset) and attempting exfiltration via Rclone to cloud storage.MicropsiaMantis uses custom malware and its most recent toolset includes the backdoors Trojan.Micropsia and Trojan.AridGopher.Phoenix[T1566.001] Spearphishing Attachment – Malicious Office attachments were used to deliver the Phoenix backdoor: (‘The attackers leveraged a malicious Office attachment that has technical overlap with previously reportedShamoonmalware has been used in destructive operations historically and in recent attacks (e.g., BibiWiper, Shamoon): (‘wiper encrypted files on the hard disk before overwriting the master boot record (MBR) and crashingStagecompto “Amy Cherne” and “Donald Gay”), hosting on Backblaze S3 endpoints, and links to previously observed Stagecomp/Darkcomp activity, indicating a coordinated Iranian espionage campaign with potential for disruptiveStuxnetthe most infamous cyber incidents to ever take place in the Middle East region was the deployment of the Stuxnet worm, which was designed to break laboratory equipment used by Iranian scientists to enrich uranium at
Vendors
BackblazeThe activity involved signed malware (certificates issued to “Amy Cherne” and “Donald Gay”), hosting on Backblaze S3 endpoints, and links to previously observed Stagecomp/Darkcomp activity, indicating a coordinatedWasabiAttempted data exfiltration using Rclone to a Wasabi cloud storage bucket was observed for the software company; payloads and backdoors were also hosted on Backblaze S3 endpoints (gitempire and elvenforest buckets).
Products
Tools
AnyDesk– Legitimate remote access tools and RATs were hosted/used for persistence and remote control (PDQ, AnyDesk, ScreenConnect): (‘the C&C server also reportedly hosted the PDQ remote access tool’ and ‘Use of thePDQTools – Legitimate remote access tools and RATs were hosted/used for persistence and remote control (PDQ, AnyDesk, ScreenConnect): (‘the C&C server also reportedly hosted the PDQ remote access tool’ and ‘Use ofRClonecorporate and NGO networks since February 2026, deploying novel backdoors (Dindoor using Deno, and Python-based Fakeset) and attempting exfiltration via Rclone to cloud storage.reGeorgUse of ReGeorg web shellsScreenConnectremote access tools and RATs were hosted/used for persistence and remote control (PDQ, AnyDesk, ScreenConnect): (‘the C&C server also reportedly hosted the PDQ remote access tool’ and ‘Use of the remote desktop
Countries
Canadaand Canada, have experienced suspicious activity on their networks in recent days and weeks.Iransoftware company’s Israeli office, and a Canadian non-profit starting February 2026 and continuing after recent U.S./Israeli strikes on Iran.IsraelThe software company is a supplier to the defense and aerospace industries among others, and has a presence in Israel, with the company’s Israel operation seeming to be the target in this activity.United StatesSeedworm (aka MuddyWater/Temp Zagros/Static Kitten) has been observed active on multiple U.S.
Industries
Defense and aerospaceThe software company is a supplier to the defense and aerospace industries among others, and has a presence in Israel, with the company’s Israel operation seeming to be the target in this activity.Softwaresoftware company’s Israeli office, and a Canadian non-profit starting February 2026 and continuing after recent U.S./Israeli strikes on Iran.