Iran

Cybersecuritynews •Tushar Subhra Dutta • August 26, 2026

Iran-linked operators are using a trusted developer tool to conceal a backdoor called Dindoor inside Windows environments. The malware uses the Deno JavaScript and TypeScript runtime to execute encoded code, helping its activity blend into legitimate software use. Dindoor has appeared as a later-stage payload in spearphishing intrusions. Researchers observed it at U.S. software and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iran-Linked Threat Actors Deploy Dindoor Backdoor via Deno Runtime Iran-linked threat actors associated with MuddyWater are exploiting a Windows backdoor named Dindoor. This malware utilizes the legitimate Deno runtime to execute malicious JavaScript and TypeScript payloads, making detection challenging. Dindoor has been observed as a later-stage payload in spearphishing attacks targeting U.S. software companies. The campaign highlights the risks of trusted developer tools being misused for malware execution, complicating traditional detection methods. The full scope of the impact remains unclear, but the use of legitimate software for malicious purposes raises significant security concerns. Organizations using Deno or similar developer tools should be vigilant and enhance their monitoring capabilities. 2 sources 73

Extracted Entities

Iran

The full story

Extracted Entities

Attack Types (2)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)