Iran’s MuddyWater Hackers Just Hit 9 Countries in One Quarter — Including a Major Samsung Supplier

Iran’s most active cyber espionage group just had its busiest quarter on record. MuddyWater — the hacking group linked to Iran’s Ministry of Intelligence and Security — breached at least nine organizations across nine countries on four continents in the first quarter of 2026. Among the victims: a major South Korean electronics manufacturer, a Middle Eastern international airport, Southeast Asian industrial manufacturers, and a Latin American financial services provider.

But the most unsettling detail isn’t who they hit — it’s how. MuddyWater used legitimately signed security software binaries, including ones from SentinelOne, to execute their malicious payloads. They literally weaponized cybersecurity tools to conduct espionage.

MuddyWater Iran Espionage Campaign in 2026

The campaign was uncovered by Symantec’s Threat Hunter Team and Carbon Black researchers, who published their findings on May 26, 2026. Also known as Seedworm, Temp Zagros, and Static Kitten, MuddyWater has been active since at least 2017 and is widely attributed to Iran’s Ministry of Intelligence and Security (MOIS).

This latest campaign stands out for its geographic breadth and the diversity of targeted sectors. Previous MuddyWater operations typically focused on the Middle East and South Asia. The Q1 2026 campaign expanded to include targets in South Korea, Southeast Asia, and Latin America — regions where Iranian cyber operations have historically been less active.

The targeted sectors span industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services. This diversity suggests either multiple tasking directives from Iranian intelligence or a broad reconnaissance effort to establish footholds for future operations.

Who Got Hit: 9 Countries, 4 Continents

The most high-profile victim is a major South Korean electronics manufacturer, where attackers spent approximately a week inside the network in February 2026. Given South Korea’s role as a global hub for semiconductor and display manufacturing, this intrusion has significant implications for industrial espionage and supply chain security.

Other confirmed victims include an international airport in the Middle East, where compromise of aviation infrastructure raises obvious national security concerns. Southeast Asian industrial manufacturers were also targeted, suggesting interest in manufacturing processes and supply chain intelligence. A Latin American financial services provider rounds out the list, indicating an expansion of MuddyWater’s traditional geographic focus.

The specific identities of all nine organizations haven’t been publicly disclosed, but the pattern suggests a coordinated intelligence collection campaign rather than opportunistic hacking. Each target appears selected for its strategic value to Iranian intelligence priorities.

How MuddyWater Used Your Security Tools Against You

The most technically interesting aspect of this campaign is MuddyWater’s heavy reliance on DLL side-loading using legitimately signed binaries. Specifically, the attackers used signed executables from Fortemedia (fmapp.exe) and SentinelOne (sentinelmemoryscanner.exe) to execute their malicious DLLs.

DLL side-loading exploits the way Windows loads dynamic link libraries. When a legitimate program starts, it looks for specific DLL files. If an attacker places a malicious DLL with the right name in the right location, the legitimate program loads it automatically. Because the parent process is legitimately signed, most security tools trust it — and by extension, trust the malicious DLL it loads.

Using SentinelOne’s binary is particularly ironic. SentinelOne is an endpoint detection and response (EDR) platform — literally a cybersecurity tool designed to detect and prevent attacks. By abusing its signed binary, MuddyWater effectively turned a security product into an attack vector. The SentinelOne binary is trusted by other security tools, whitelisted in many environments, and generally considered above suspicion.

This technique isn’t new, but MuddyWater’s implementation is notably sophisticated. The malicious DLLs are designed to blend with the legitimate software’s expected behavior, making detection through behavioral analysis significantly harder. AI-enhanced threat detection may be needed to catch these subtle indicators.

The Microsoft Teams Social Engineering Angle

Beyond the DLL side-loading attacks, MuddyWater also operated a parallel social engineering campaign using Microsoft Teams. Beginning in early 2026, the group used compromised Teams accounts to send messages to targets, abusing the trust that employees place in internal communication platforms.

The Teams-based attacks aimed to harvest credentials and bypass multi-factor authentication — a technique gaining popularity among state-sponsored actors who recognize that MFA, while essential, can be circumvented through social engineering rather than technical exploitation.

The combination of technical sophistication (DLL side-loading) and social engineering (Teams phishing) demonstrates MuddyWater’s maturation as a threat actor. They’re no longer relying on a single attack vector — they’re running multi-pronged campaigns that attack both the technology stack and the human element simultaneously.

MuddyWater’s Evolution: From Scripts to Sophistication

MuddyWater’s journey from a relatively unsophisticated group using basic PowerShell scripts to an operation capable of penetrating a major electronics manufacturer across continents reflects the broader evolution of Iranian cyber capabilities.

In 2017 and 2018, MuddyWater campaigns were characterized by relatively simple malware and heavy reliance on spear-phishing emails. By 2024, the group had adopted more sophisticated tools including the Dindoor backdoor for targeting US networks. The Q1 2026 campaign represents another leap forward, with living-off-the-land techniques, legitimate binary abuse, and multi-platform social engineering.

This evolution tracks with increased Iranian investment in cyber operations following the collapse of the JCPOA nuclear deal and escalating regional tensions. Cyber espionage offers Iran a way to project power and gather intelligence at a fraction of the cost of conventional intelligence operations.

Why This Matters for Manufacturing and Critical Infrastructure

The targeting of electronics manufacturers and airports has implications beyond immediate data theft. Manufacturing espionage can provide insights into production processes, quality control systems, and supply chain relationships that have both economic and strategic value.

For the South Korean electronics maker specifically, a week-long intrusion could have exposed proprietary chip designs, manufacturing processes, customer relationships, and strategic plans. In an industry where intellectual property is the primary competitive advantage, this kind of access is devastating.

The airport intrusion raises different but equally serious concerns. Aviation infrastructure is classified as critical infrastructure in virtually every country. Access to airport systems could provide intelligence on passenger movements, cargo operations, security procedures, and communications infrastructure.

How to Defend Against DLL Side-Loading Attacks

Defending against DLL side-loading is challenging precisely because it abuses legitimate software. Standard recommendations include application whitelisting that verifies DLL integrity in addition to executable signatures, monitoring for unusual DLL loading patterns in security tool processes, implementing strict folder permissions to prevent DLL placement in application directories, deploying behavioral detection that looks for known side-loading chains, and keeping security tool binaries in protected directories with integrity monitoring.

For organizations concerned about the MuddyWater campaign specifically, security teams should audit for the presence of fmapp.exe and sentinelmemoryscanner.exe in unexpected locations, review Microsoft Teams external communication logs for suspicious activity, and scan for known MuddyWater indicators of compromise published by Symantec and Carbon Black.

The Bottom Line

MuddyWater’s Q1 2026 campaign demonstrates that state-sponsored cyber espionage is becoming simultaneously more global and more sophisticated. The expansion to four continents, the abuse of security tool binaries, and the parallel social engineering operations all point to a group — and a country — that is investing heavily in cyber capabilities.

For organizations in manufacturing, critical infrastructure, and financial services, the message is clear: nation-state actors are actively targeting your networks, and they’re using your own security tools to do it. Traditional perimeter defenses aren’t enough when the attacker is inside your EDR vendor’s signed binary.