The MuddyWater campaign shows how espionage groups continue to rely on practical, low-noise techniques rather than flashy zero-days. According to the report, the Iranian-linked group targeted at least nine organizations across nine countries in the first quarter of 2026, including industrial manufacturing, electronics, education, public-sector bodies, financial services, and professional services. The campaign also affected a major South Korean electronics manufacturer, where attackers reportedly remained inside the network for about a week.

The heavy use of DLL side-loading is especially important. MuddyWater abused legitimately signed binaries, including Fortemedia fmapp.exe and SentinelOne sentinelmemoryscanner.exe, to load malicious DLLs while appearing like trusted software. That is exactly why defenders cannot rely only on whether a binary is signed. A signed executable can still become the delivery vehicle for malicious code, because Windows trust decisions apparently enjoy being exploited with paperwork. 

The campaign also included credential theft and stealthy access techniques. The malicious DLLs embedded ChromElevator to steal passwords, cookies, and payment card data from Chromium-based browsers, bypassing App-Bound Encryption protections. Attackers also used Node.js to launch PowerShell scripts for reconnaissance, screenshot capture, SAM hive theft, privilege escalation, SOCKS5 reverse-proxy tunnelling, and data staging on public file-transfer services. 

Organizations should monitor for suspicious execution of signed binaries from unusual paths, unexpected DLL loads, abnormal PowerShell activity, Node.js launching scripts, browser credential access, SAM hive access, and outbound tunnels to unknown infrastructure. Security teams should also enforce application control, monitor DLL search-order abuse, restrict script execution, harden endpoint credential storage, and inspect use of public file-transfer platforms. 

The larger lesson is simple: advanced attacks often succeed by abusing legitimate tools and trusted software behavior. Defenders need behavioral visibility, not just signature checks. If a trusted binary loads an unexpected DLL, starts reconnaissance, steals browser data, and opens a proxy tunnel, the signature on the executable is no longer the most interesting part of the story.

The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. The activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.

Source: MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries via The Hacker News — published 26 May 2026.