Iran-Linked Hackers Exploit Legitimate Dev Tool to Conceal Didoor Backdoor

Key Takeaways

• Iranian threat actors are deploying a new backdoor, “Dindoor,” by exploiting the legitimate Deno JavaScript/TypeScript runtime.
• The malware campaign targets U.S. software and banking sectors, as well as a Canadian non-profit.
• Dindoor uses multiple stages, Base64 encoding, and evasion techniques to hide its activities and avoid detection in virtual environments.
• Detection relies on behavioral analysis of process chains and registry changes rather than static file signatures.

Iranian Hackers Leverage Legitimate Dev Tool to Conceal Didoor Backdoor

A sophisticated new backdoor, dubbed Didoor, is being deployed by Iranian state-sponsored threat actors within Windows environments. The malware achieves stealth by embedding itself within the Deno JavaScript and TypeScript runtime, a legitimate developer tool, allowing its malicious activities to masquerade as benign software operations.

Dindoor has been observed as a secondary payload in targeted spearphishing campaigns. Researchers have documented its presence in intrusions affecting U.S.-based software and banking organizations, alongside a Canadian non-profit, underscoring its broad sectoral reach.

Didoor’s Operational Modus Operandi

Analysts at Binary Defense said in a report that they began tracking this backdoor in early 2026, attributing its activity to MuddyWater, a known Iranian state-backed threat group. The report, also shared with Cyber Security News (CSN), highlights that Didoor combines a signed runtime, Base64 encoding, and specific checks designed to thwart analysis efforts. This approach is significant because it avoids relying on easily blockable, unusual executables. Instead, it weaponizes common Windows utilities and a trusted runtime, transforming seemingly legitimate activities into dangerous components of an attack chain.

The infection sequence typically begins after an initial phishing stage compromises a device and installs a loader. This loader first checks for the presence of Deno; if absent, it utilizes curl to download the runtime. Subsequently, Deno is launched with an extended Base64-encoded argument that contains the Didoor code. This tactic provides a plausible cover story for the attackers, as Deno, being signed software for JavaScript and TypeScript execution, does not inherently trigger suspicion. However, an unexpected Deno installation on a non-developer workstation, particularly after a phishing incident or unusual script execution, should raise immediate red flags.

The initial script gathers host information, establishes communication with a remote command-and-control server, and then compiles a subsequent payload. This second stage retrieves and executes a third, creating a layered execution chain. This modular approach complicates forensic investigations and grants the attackers flexibility to modify later components as needed.

Before establishing persistence, the final stage of Didoor performs an environment check. It queries the machine’s graphics adapter via PowerShell Windows Management Instrumentation (WMI). The presence of names associated with virtualized environments like VMware, VirtualBox, QXL, or Hyper-V triggers the malware to halt, preventing its full malicious behavior from being exposed in automated analysis systems.

Only after confirming it is likely operating on a genuine victim machine does Didoor establish persistence. It achieves this by creating a Windows Run registry entry that launches a VBScript via wscript, ensuring the backdoor reactivates upon user login. This staged and evasive methodology mirrors multi-stage custom malware payloads previously employed by MuddyWater to maintain access while minimizing visibility.

Behavioral Detection is Key

Didoor’s network communications leverage Deno’s listen function to establish a TCP listener, with data further obfuscated through Base64 encoding. Given that the tools used are legitimate and signed, traditional file hash or static signature-based detections may only identify known versions. Therefore, defenders must shift their focus to behavioral analysis.

High-fidelity detection signals include Deno being launched with an unusually long encoded argument, curl contacting the Deno download domain on systems without a legitimate development role, and a Windows Run key pointing wscript to a script located within the AppData Local directory. Furthermore, any PowerShell query for graphics adapter information initiated by cmd, especially when preceding new persistence mechanisms, warrants immediate investigation. This emphasis on behavioral tracking aligns with lessons learned from previous campaigns, such as the PhonyC2 command framework, where monitoring evolving attacker methods proved more effective than relying on specific tool names.

What You Should Do

• Review Deno Usage: Audit systems for authorized Deno installations. Flag any unauthorized downloads or executions, particularly on non-developer workstations.
• Implement Strong Phishing Defenses: Enhance email security gateways to inspect attachments and links rigorously. Train users to recognize and report spearphishing attempts.
• Monitor Process and Registry Telemetry: Correlate user phishing reports with endpoint telemetry, specifically looking for unusual process chains involving curl.exe, deno.exe, wscript.exe, and powershell.exe.
• Restrict Script Execution: Enforce script execution policies to limit PowerShell and VBScript execution to only where business needs explicitly justify it.
• Investigate Suspicious Commands: Pay close attention to PowerShell commands querying system hardware, particularly graphics adapters, when launched by cmd.exe and followed by persistence attempts.
• Regular Endpoint Reviews: Conduct routine endpoint security reviews, focusing on new persistence mechanisms and atypical software installations or executions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.