DinDoor is a Deno runtime-based backdoor distributed via MSI installers that execute obfuscated JavaScript for C2 communication and system fingerprinting. Two analyzed samples differ in execution: one persists JavaScript on disk, the other executes solely in memory. Both generate unique victim identifiers using identical fingerprinting algorithms. Embedded JWT tokens in one sample expose campaign metadata and a domain (serialmenot[.]com) linked to multi-tenant infrastructure serving multiple threat actors, including state-sponsored and cybercriminal groups. Network analysis revealed 20 active C2 servers across 15 autonomous systems, many leveraging bulletproof hosting. The infrastructure uses the Caddy proxy with unique HTTP headers, which can be used for detection. The malware is associated with the MuddyWater threat actor. No patches or vendor advisories are available, and no known active exploitation has been reported.

DinDoor enables attackers to maintain persistent command and control over compromised systems through obfuscated JavaScript executed in the Deno runtime environment. It performs system fingerprinting to uniquely identify victims, facilitating targeted operations. The use of multi-tenant infrastructure and bulletproof hosting complicates takedown efforts and attribution. The presence of multiple active C2 servers indicates ongoing campaign activity. While no known exploits in the wild have been reported, the malware's capabilities pose a medium risk of unauthorized access and data exfiltration.

No official patch or remediation is currently available for DinDoor. Since this is malware delivered via MSI files exploiting the Deno runtime, organizations should focus on preventing initial infection vectors such as blocking malicious MSI files and monitoring for suspicious Deno runtime activity. Network defenders can leverage detection of distinctive Caddy proxy HTTP headers to identify potential C2 communications. Given the lack of vendor advisories or patches, continuous monitoring and threat intelligence updates are recommended to respond to emerging indicators.