DinDoor is a Deno runtime-based backdoor distributed via MSI installers. It executes obfuscated JavaScript code to perform command and control communications and system fingerprinting, generating unique victim identifiers. Two analyzed samples show different execution approaches: disk-based JavaScript writing and in-memory execution. The malware infrastructure includes 20 active C2 servers identified through HTTP header analysis, many hosted on bulletproof hosting providers and employing Caddy proxy with identifiable headers. The domain serialmenot[.]com is part of a multi-tenant infrastructure used by multiple threat actors, including the MuddyWater group. The malware's use of the Deno runtime and obfuscated JavaScript represents a novel approach to persistence and C2 communication.

DinDoor enables attackers to maintain persistent command and control over compromised systems, perform system fingerprinting to uniquely identify victims, and potentially execute arbitrary commands via the Deno runtime. The use of multi-tenant infrastructure and bulletproof hosting complicates takedown efforts and attribution. Although no active exploitation in the wild is currently reported, the presence of multiple active C2 servers indicates ongoing malicious campaigns. The malware's obfuscation and in-memory execution techniques may hinder detection and forensic analysis.

No official patch or remediation guidance is currently available for DinDoor. Since it is delivered via MSI files, organizations should implement strict controls on software installation and execution policies, including application whitelisting and monitoring for unusual use of the Deno runtime. Network defenders can leverage detection of distinctive Caddy proxy HTTP headers associated with the malware's C2 infrastructure for network-based detection and blocking. Regular threat intelligence updates and monitoring for indicators related to serialmenot[.]com and associated C2 servers are recommended. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources for updates.