Seedworm APT uses DLL sideloading with signed Fortemedia, SentinelOne binaries

Key Takeaways

• The Iran-linked APT group Seedworm launched an extensive espionage campaign in early 2026, compromising at least nine organizations across four continents.
• Attackers leveraged DLL sideloading by abusing legitimate, signed Fortemedia and SentinelOne binaries to execute malicious code, making detection difficult.
• Targets included critical sectors such as industrial manufacturing, government, finance, education, and a major Middle Eastern airport, indicating a broad intelligence collection objective for Tehran.
• The group employed advanced techniques, including Node.js for orchestration and the public file-transfer service sendit[.]sh for stealthy data exfiltration.

Iran-Backed Seedworm APT Unleashes Sophisticated DLL Sideloading Campaign on Global Targets

An advanced persistent threat (APT) group, widely believed to be operating on behalf of Iran’s Ministry of Intelligence and Security, has executed a sweeping espionage operation in early 2026. This group, known as Seedworm (also tracked as MuddyWater, Temp Zagros, and Static Kitten), successfully infiltrated at least nine organizations spanning nine countries and four continents.

The campaign distinguished itself through its sophisticated use of DLL sideloading, a technique that exploits trusted, signed software to surreptitiously load malicious dynamic-link libraries. This method allows the attackers to blend their nefarious activities with legitimate system processes, significantly complicating detection by conventional security tools.

Broad Targeting Indicates Strategic Intelligence Collection

The scope of Seedworm’s targets was diverse and strategic, encompassing industrial and electronics manufacturing, government entities, financial services, educational institutions, and a prominent international airport in the Middle East. Security analysts at Symantec, who identified and detailed the campaign, suggest this wide array of targets points to a concerted effort by Tehran to gather intelligence, ranging from manufacturing secrets to sensitive governmental information.

One notable incident involved a major South Korean electronics manufacturer, where the attackers maintained a covert presence within the network for a full week in February 2026, demonstrating their ability for prolonged, undetected access.

Advanced Evasion Tactics: DLL Sideloading and Node.js Orchestration

The core of Seedworm’s stealth capabilities lay in its innovative use of DLL sideloading. Instead of deploying overt malware, the threat actors introduced legitimate, signed executables alongside their malicious DLLs. When these trusted programs were launched, they inadvertently loaded the adjacent malicious files, an action typically trusted by security solutions due to the binaries’ valid digital signatures.

Specifically, the campaign abused two legitimate executables: fmapp.exe, an audio-driver utility from Fortemedia Inc., which was used to sideload a malicious fmapp.dll; and sentinelmemoryscanner.exe, a component of an endpoint security product, which loaded a malicious sentinelagentcore.dll. Both malicious DLLs were equipped with ChromElevator, a tool designed to steal sensitive data such as passwords, cookies, and payment information from web browsers.

A significant evolution in Seedworm’s tactics was the shift from raw PowerShell commands to orchestrating the attack chain via node.exe, the Node.js runtime. A Node.js script embedded within an XML file on compromised machines silently managed the entire operation. This change makes the attack harder to trace and detect compared to the group’s previous methods.

To ensure persistent access, the attackers established registry entries under the Windows startup key, enabling the malicious loader chain to reactivate with each user login. They also deployed multiple credential theft tools, including methods to dump password hashes from registry hives, present fake Windows login dialogs, and use a privilege escalation tool to extract Kerberos tickets from high-privilege accounts without requiring their passwords.

Layered Credential Theft and Data Exfiltration

Upon gaining initial access, the Seedworm operators systematically progressed through the target networks. They initiated discovery commands to map the compromised machine, identify the user, and understand the domain architecture. Screenshots were also captured to monitor victim activities.

PowerShell scripts were retrieved from a staging server using both PowerShell and the curl utility. The use of curl was a deliberate choice to bypass script-block logging, a common defense mechanism for PowerShell activity.

The deployment of credential theft tools in multiple phases highlights the attackers’ redundancy strategy, ensuring that even if one method failed, others would succeed. The stolen registry hives could be used for offline cracking of password hashes and recovery of cached domain credentials. Symantec’s analysis notes that this methodical, redundant approach within a single intrusion signifies the increasing sophistication and maturity of the Seedworm threat actor.

For data exfiltration, Seedworm leveraged a public file-transfer service, sendit[.]sh. This tactic allowed them to mask data theft within routine cloud traffic, which often bypasses traditional security filters, thereby avoiding the need for custom command-and-control infrastructure and reducing the risk of detection.

What You Should Do

• Monitor DLL Sideloading: Actively monitor for unsigned DLLs being loaded by legitimate, signed executables, especially those from Fortemedia and SentinelOne. Implement endpoint detection and response (EDR) solutions capable of detecting such anomalies.
• Inspect Node.js Activity: Scrutinize unexpected or suspicious Node.js (node.exe) processes, particularly those initiating unusual network connections or file operations.
• Strengthen Registry Security: Enforce strict policies on Windows startup registry keys to prevent unauthorized entries that establish persistence. Regularly audit these keys for malicious additions.
• Enhance Outbound Traffic Filtering: Block outbound traffic to unknown or suspicious file-transfer services. Implement web content filtering and proxy solutions to control and log external communications.
• Implement Multi-Factor Authentication (MFA): Deploy MFA across all accounts, especially for privileged users, to mitigate the impact of stolen credentials.
• Regularly Audit and Patch: Maintain a rigorous patching schedule for all operating systems and applications, and conduct regular security audits to identify and remediate vulnerabilities.
• Educate Users: Train employees on phishing awareness and the dangers of suspicious attachments or links, as initial access often relies on social engineering.
• Review Indicators of Compromise (IoCs): Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) and threat intelligence platforms for proactive detection.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.