Iranian APT Seedworm Targets Global Organizations via Microsoft Teams

In late February 2026, following escalating Middle East tensions and coordinated military actions, Iranian APT group Seedworm launched sophisticated social engineering attacks via Microsoft Teams. Attackers impersonated IT support personnel using deceptive Microsoft 365 tenant domains to convince victims to execute malicious MSI installers. The campaign deployed a custom backdoor called Dindoor, which leveraged legitimate Deno runtime to execute obfuscated payloads in-memory, minimizing detection. The operation included multiple components for persistence, command-and-control communications, and data exfiltration. Infrastructure overlapped with previously reported MuddyWater operations. The attack demonstrates the group's evolution in using collaboration platforms as initial access vectors while combining dual-use tooling with living-off-the-land techniques to bypass traditional security controls.

• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Locked and Loaded: Phishing through Fake Bids and Protected DocumentsCampaign2026-10-27
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14