Seedworm, an Iranian state-sponsored threat actor also known as MuddyWater, executed a widespread espionage campaign in early 2026 compromising organizations in nine countries across four continents. The campaign employed DLL sideloading techniques leveraging legitimately signed Fortemedia and SentinelOne binaries to execute malicious payloads. Node.js-based implants were deployed for command and control orchestration, complemented by multiple PowerShell scripts facilitating reconnaissance, credential theft, and privilege escalation. Data exfiltration was conducted through the public file-transfer service sendit.sh, allowing attackers to mask malicious traffic within legitimate cloud service usage. Targets included a major South Korean electronics manufacturer, government agencies, an international airport in the Middle East, Southeast Asian industrial manufacturers, a Latin American financial services provider, and educational institutions. The campaign demonstrates Seedworm's evolved tactics and expanded geographic targeting beyond their traditional Middle Eastern focus.

The campaign resulted in unauthorized access and espionage across multiple sectors and continents, including industrial, governmental, financial, and educational organizations. The use of DLL sideloading with legitimate binaries and public cloud services for data exfiltration complicates detection and mitigation efforts. Credential theft and privilege escalation increase the risk of persistent access and further compromise within victim networks. Although no known exploits in the wild are reported, the campaign's medium severity reflects significant operational impact on targeted organizations.

No specific patch or official remediation is indicated for this campaign. Organizations should focus on detecting and preventing DLL sideloading attacks, monitoring for unusual use of legitimate signed binaries, and scrutinizing PowerShell script execution. Monitoring network traffic for anomalous connections to public file-transfer services like sendit.sh is recommended. Since this is an espionage campaign without a disclosed vulnerability or patch, mitigation relies on enhanced detection and response capabilities tailored to the described tactics. Patch status is not yet confirmed — check vendor advisories and threat intelligence sources for updates.