Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign

Iranian state-sponsored threat group Seedworm conducted a widespread espionage campaign in early 2026, compromising at least nine organizations across nine countries on four continents. Victims included a major South Korean electronics manufacturer, government agencies, an international airport in the Middle East, Southeast Asian industrial manufacturers, a Latin American financial services provider, and educational institutions. The attackers utilized DLL sideloading techniques with legitimately signed Fortemedia and SentinelOne binaries to execute malicious payloads, deployed Node.js-based implants for orchestration, and employed multiple PowerShell scripts for reconnaissance, credential theft, and privilege escalation. Data exfiltration was conducted through public file-transfer service sendit.sh to blend malicious traffic with legitimate cloud services. The campaign demonstrates Seedworm's evolved tradecraft and expanded targeting beyond traditional Middle Eastern focus areas.

• Cavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCampaign2026-07-06
• Lunex Unmasked: A New Information Stealer Deployed Through BYOVDMalware2026-09-26
• Beyond testmetest: Native Addon Camouflage and 42 Armed GitHub Repositories Reveal a Hidden npm PublisherMalware2026-10-26
• Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy CirclesCampaign2026-10-01
• Star Blizzard refines phishing and malware delivery with the RedFlick techniqueMalware2026-09-30