Seedworm APT Abuses Fortemedia & SentinelOne Signed Binaries

A recent campaign by Iran-linked threat actors reveals a significant evolution in their methods. These adversaries have been subtly infiltrating global networks, demonstrating a level of calculated precision not previously observed.

The group known as Seedworm, also tracked as MuddyWater, spent the first quarter of 2026 targeting at least nine organizations across nine countries on four continents, leaving a trail of stolen data and compromised credentials.

The targets ranged widely, touching industrial and electronics manufacturing firms, educational institutions, government agencies, financial services providers, and even an international airport in the Middle East.

One of the most striking intrusions took place in February 2026, when the group spent a full week inside the network of a major South Korean electronics manufacturer, a region far outside its traditional hunting ground.

Analysts from Symantec’s Threat Hunter Team identified the campaign and linked it to Seedworm, a group widely believed to operate on behalf of Iran’s Ministry of Intelligence and Security.

The researchers noted that every targeted organization likely held information of direct intelligence value to Tehran, whether that was intellectual property, government data, or access to downstream customers.

Abusing Signed Binaries for DLL Sideloading

What stands out is not just the range of victims, but how the attackers moved through their targets. Rather than relying on noisy, easily detected methods, Seedworm showed a level of operational discipline that signals real maturity in its tradecraft. The attackers blended their techniques to stay hidden, move quietly, and extract data without triggering obvious alarms.

The group also updated its tooling, mixing familiar tools with new delivery methods and choosing exfiltration paths that are harder to detect. This campaign is a clear reminder that state-linked espionage actors are constantly refining their approach, and defenders need to stay ahead.

The most striking technique in this campaign was how the attackers turned trusted software against the organizations it was supposed to protect. They dropped pairs of files on targeted systems: one legitimate, signed executable, and one malicious DLL crafted to be secretly loaded by it.

The first pair used fmapp.exe, a legitimate audio-driver utility, to load a malicious file called fmapp.dll. The second pair was more provocative: sentinelmemoryscanner.exe, a legitimate component from a well-known security product, was used to sideload a malicious file called sentinelagentcore.dll. By sheltering behind trusted, signed software, the attackers made their activity look benign at a glance, defeating both path-based and signature-based detection.

Both malicious DLLs carried ChromElevator, a post-exploitation tool capable of stealing passwords, cookies, and payment card data from Chromium-based browsers. In every observed case, the parent process launching these files was node.exe, meaning a Node.js script was driving the entire sideloading chain rather than a human operator at a keyboard.

Credential Theft, Exfiltration, and Defensive Steps

Once inside a network, the attackers wasted no time collecting credentials and locking in their access. They used registry changes to ensure their loader chain would restart every time the affected user logged in. They also dumped Windows registry hives containing password hashes, giving them offline material for cracking and lateral movement.

Multiple credential-theft tools were deployed in rapid succession, showing the attackers wanted redundancy in case any single method was caught. One tool triggered a fake Windows login prompt to harvest a password and saved it to a plaintext file on disk. Another automated Kerberos ticket extraction without ever needing a domain administrator’s password.

For exfiltration, the group used sendit[.]sh, a public file-transfer service, to move stolen files off the network. Routing data through a consumer cloud platform is a deliberate tactic to blend malicious traffic with ordinary internet activity. Organizations should monitor for unexpected use of public file-sharing services and audit all outbound transfers from sensitive directories.

Defenders should also watch for unusual node.exe process trees, unexpected DLL loads from signed third-party binaries, and PowerShell pulling content from external staging servers. Keeping endpoint detection rules current and reviewing registry run keys regularly can reduce the window attackers have to maintain their foothold.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.