Iran

Gbhackers •Mayura Kathir • August 26, 2026

Iran-linked threat actors associated with MuddyWater are using a newly tracked Windows backdoor dubbed Dindoor that hijacks the legitimate Deno runtime to execute malicious JavaScript and TypeScript payloads. The campaign demonstrates how trusted developer tooling can be turned into an effective execution layer for malware while reducing the value of file-signature and hash-based detection. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iran-Linked Threat Actors Deploy Dindoor Backdoor via Deno Runtime Iran-linked threat actors associated with MuddyWater are exploiting a Windows backdoor named Dindoor. This malware utilizes the legitimate Deno runtime to execute malicious JavaScript and TypeScript payloads, making detection challenging. Dindoor has been observed as a later-stage payload in spearphishing attacks targeting U.S. software companies. The campaign highlights the risks of trusted developer tools being misused for malware execution, complicating traditional detection methods. The full scope of the impact remains unclear, but the use of legitimate software for malicious purposes raises significant security concerns. Organizations using Deno or similar developer tools should be vigilant and enhance their monitoring capabilities. 2 sources 73

Extracted Entities

Iran

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)