Reported by 2 outlets

Timeline

1. original reporting

   Seedworm (MuddyWater) expands global espionage — abuses signed Fortemedia and SentinelOne binaries for DLL sideloading

   bleepingcomputer.com · 153d ago · May 14th, 2026

   Symantec has documented a broad Seedworm campaign targeting at least nine organizations across government, manufacturing, finance, aviation, and education sectors on four continents. The campaign centers on a week-long intrusion into a major South Korean electronics manufacturer in February 2026, during which the Iranian MOIS-linked group spent seven days performing reconnaissance, credential theft via fake Windows prompts and registry hive extraction, and persistent access through registry modifications and 90-second beacon intervals. The group's tooling has evolved: rather than direct PowerShell execution, payloads are now controlled through Node.js loaders. Most notably, Seedworm abused legitimate signed binaries — Fortemedia's fmapp.exe audio utility and SentinelOne's sentinelmemoryscanner.exe — to sideload malicious DLLs (fmapp.dll and sentinelagentcore.dll) containing the ChromElevator post-exploitation tool for Chrome-based data theft. Data exfiltration uses sendit.sh, a public file-sharing service, to blend with legitimate traffic.

2. update from cyberpress.org

   Seedworm (MuddyWater) Weaponizes Signed SentinelOne and Fortemedia Binaries in Global Espionage Campaign

   cyberpress.org · 140d ago · May 27th, 2026

   Iran-linked Seedworm (MuddyWater / Static Kitten, operating under MOIS) breached a major South Korean electronics manufacturer as part of a sprawling early-2026 campaign spanning government agencies, airports, financial services, and industrial manufacturers across four continents — signaling a broadened intelligence-gathering mandate beyond the Middle East. The campaign demonstrates significantly matured tradecraft. Attackers deployed DLL sideloading via validly signed third-party executables: fmapp.exe (Fortemedia Audio Utilities) loaded a malicious fmapp.dll, and sentinelmemoryscanner.exe — a signed SentinelOne security binary — loaded sentinelagentcore.dll. Both deployed ChromElevator, a publicly available post-exploitation tool for extracting browser passwords, cookies, and payment data from Chromium-based browsers. Seedworm shifted from heavy PowerShell usage to Node.js-based automation, with node.exe observed as the grandparent process for hijacked binaries — indicating automated loader infrastructure rather than hands-on-keyboard operation. Credential theft targeted SAM/SECURITY/SYSTEM hives for NTLM hashes and specialized tools for Kerberos TGT extraction. Exfiltration used sendit.sh, a public file-transfer service, blending stolen data with normal consumer cloud traffic.