The MuddyWater campaign challenges detection: signed binaries, DLL ide-loading and global espionage in 2026

A new episode of cyberespionage attributed to the Iranian group known as MuddyWater reveals a more refined and stealth campaign that has affected at least nine organizations on four continents during the first quarter of 2026. Although the techniques used are not, individually, a novelty, their combination and the operational discipline observed reflect a worrying evolution: the attackers prioritize discretion, the use of legally signed binaries to mask their activity and open tools to exfilter sensitive information.

The confirmed targets include industrial and electronic manufacturers, educational and public sector entities, financial services and an international airport in the Middle East. In the case of a large South Korean manufacturer, the intruders remained at least one week within their network, carrying out repeated recognition and re- execution of payloads to "ensure" persistence. The ability to remain latent and reactivate components compromises traditional signature-based detection and requires a response focused on behavior and telemetry.

One of the most outstanding tactics is the abuse of DLL ide-loading by legitimate signed binaries: fmapp.exe (Fortemendia) and sentinelmemoryscanner.exe (associated with security products) were documented to load malicious DLs that passed through benign components. These DLs included a module known as Chromeelevator, designed to extract passwords, cookies and payment data from Chromium-based browsers, mocking protections like App-Bound Encryption (EBA) and exposing credentials that allow side movements and sustained accesses.

In addition to the ide-loading, the campaign used node.exe execution chains to release scripts that invoke PowerShell, making discovery of the environment, capture of screens, extraction of SAM hives, climbing of privileges and establishment of SOCKS5 tunnels to pivote. In at least one incident, stolen data were temporarily lodged in a public file transfer service (sendit.sh), which points to the mix of living off the land techniques with public resources to complicate the tracking.

These behaviors fit a greater trend: state actors who invest in "operational hygiene" to reduce noise and minimize exposure, using both open source tools and reliable binary tools to avoid controls. The potential impacts range from industrial espionage and intellectual property filtration to operational interruption if the attackers decide to evolve to destructive activities, as has already been observed in campaigns related to other Iranian groups.

From a defensive perspective, traditional signature-based detection is no longer enough. It is imperative to prioritize observability and response by behavior: to monitor abnormal executions of binaries signed from non-conventional locations, to correlate the use of node.exe and PowerShell with discovery tasks, and to track outgoing communications to PIs or public file exchange services. Application control policies, strict permitted lists, and implementation of integrity controls and code execution (such as Microsoft Defender Application Control or EDR / XDR equivalents) must be integrated into the defence.

In the field of operation, immediate practical measures include the rotation of critical credentials and the requirement of multifactor authentication for remote access, the segmentation of industrial and IT networks to limit the scope of lateral movements, and the verification of offline backup and its integrity. In the face of an intrusion, the priority should be to contain communication C2, to preserve evidence for forensic analysis and, if appropriate, to implement eradication plans that include reinstallation and verification of the chain of confidence of signed binaries.

The international community has already responded with sanctions and powers to entities linked to Iranian cyberoperations, which highlights the geopolitical component of these campaigns and the likelihood that they will continue to target critical infrastructure and key economic sectors. For organisations in manufacturing, transport and finance, the risk hypothesis must change: it is not a question of whether they will suffer an attempt at intrusion, but when and with what sophistication.

Research and mitigation of these threats requires resources and collaboration: sharing indicators with security providers and national agencies, enriching detection rules with own and other telemetry, and raising incident response exercises that simulate implementation chains based on signed binaries. To deepen the techniques and tactics observed in similar campaigns and threat reference frameworks, see the MITRE ATT & CK repository to understand instrumental techniques and the MuddyWater reference page for historical context and actor profile: MITRE ATT & CK and MuddyWater (Wikipedia).

Ultimately, the combination of continuous monitoring, strict implementation controls and rapid response preparedness is the best defence against adversaries that improve their operational discipline. The key is to reduce the detection and response window and assume that attackers take advantage of both legitimate tools and open source to achieve their objectives. Organizations must now act to tighten their attack surfaces and work with industry and authorities to increase resilience to sophisticated espionage campaigns.