Seedworm: Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign

Iran-linked threat actor Seedworm (also known as MuddyWater, Temp Zagros, Static Kitten) conducted a global espionage campaign in early 2026, breaching at least nine organizations across four continents, including a major South Korean electronics manufacturer. The attackers used DLL sideloading with legitimately signed binaries from Fortemedia and SentinelOne to execute malicious payloads, leveraging Node.js scripts to orchestrate PowerShell-based reconnaissance, credential theft, privilege escalation, and SOCKS5 reverse-proxy tunneling. Data exfiltration was performed via the public file-transfer service sendit[.]sh, blending malicious traffic with legitimate cloud services to evade detection. The campaign reflects an evolution in Seedworm’s tradecraft toward more disciplined and stealthy operations.

AI-extracted · verify before operational use