Reported by 2 outlets

Timeline

1. original reporting

   MuddyWater-Linked Dindoor Backdoor Abuses Legitimate Deno Runtime to Evade Detection

   cyberpress.org · 48d ago · August 26th, 2026

   MuddyWater-linked threat actors are using a backdoor named Dindoor that abuses the legitimate Deno runtime to execute malicious code and evade security detection. Researchers at Binary Defense began tracking Dindoor in early 2026 after finding infections at U.S. software and banking organizations, as well as a Canadian non-profit. The malware is associated with the Iranian APT group MuddyWater. Dindoor does not rely on a custom interpreter. Instead, it uses Deno, a signed and widely used JavaScript and TypeScript runtime. If Deno is not already installed, the malware downloads it from deno.land using curl.exe. This approach helps Dindoor blend into normal activity. Security products may trust Deno because it is a legitimate developer tool, while the malware hides its scripts in Base64-encoded arguments. Dindoor Abuses Deno Runtime Dindoor is mainly delivered as a later-stage payload in spearphishing attacks. Once the attackers gain initial access, the loader checks whether Deno exists on the compromised Windows system. It then launches Deno with a Base64-encoded script containing the backdoor. The attack chain contains three payload stages. The first stage fingerprints the infected device, contacts a command-and-control server, and compiles a secondary payload. That payload retrieves and executes the final stage from the remote server. Before enabling its main functions, the final payload checks whether it is running inside a virtual machine or automated malware-analysis sand

2. update from gbhackers.com

   Iran-Linked Hackers Abuse Legitimate Deno Runtime to Hide Dindoor Backdoor on Windows Systems

   gbhackers.com · 48d ago · August 26th, 2026

   The campaign demonstrates how trusted developer tooling can be turned into an effective execution layer for malware while reducing the value of file-signature and hash-based detection. The […] The post Iran-Linked Hackers Abuse Legitimate Deno Runtime to Hide Dindoor Backdoor on Windows Systems appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .