Full Report
Symantec researchers disclosed that Iran-linked threat actor Seedworm breached a major South Korean electronics manufacturer in February 2026... The post Symantec uncovers Iran-linked Seedworm espionage campaign targeting airport, government, manufacturing sectors appeared first on Industrial Cyber.
Analysis Summary
# Threat Actor: Seedworm
## Attribution & Identity
* **Name:** Seedworm
* **Aliases:** MuddyWater, Temp.Zagros, Static Kitten
* **Known Associations:** Widely believed to be linked to the Iranian Ministry of Intelligence and Security (MOIS).
## Activity Summary
In February 2026, Seedworm launched a global espionage campaign targeting at least nine organizations across four continents. Notable activity included a breach of a major South Korean electronics manufacturer where the actor remained undetected for nearly a week. The campaign, which spanned the first quarter of 2026, focused on high-value intelligence gathering and intellectual property theft.
## Tactics, Techniques & Procedures
* **DLL Sideloading:** Abusing legitimately signed binaries to load malicious DLLs (fmapp[dot]exe and sentinelmemoryscanner[dot]exe).
* **Privilege Escalation & Persistence:** Deployment of a node[dot]exe-based implant chain.
* **Credential Theft:** Theft of Security Account Manager (SAM) hives and browser-stored credentials.
* **Reconnaissance:** Extensive use of PowerShell scripts for screenshot capture and system discovery.
* **Network Tunneling:** Utilization of SOCKS5 reverse-proxy tunneling to maintain access.
* **Exfiltration:** Using public file-transfer services to move stolen data out of the network.
**MITRE ATT&CK Techniques Mentioned:**
* **T1574.002:** Hijack Execution Flow: DLL Side-Loading
* **T1059.001:** Command and Scripting Interpreter: PowerShell
* **T1003:** OS Credential Dumping (SAM hive theft)
* **T1090:** Proxy (SOCKS5 reverse-proxy)
* **T1113:** Screen Capture
## Targeting
* **Sectors:** Industrial and electronics manufacturing, government agencies, aviation (international airports), education, financial services, and professional services.
* **Geography:** Global reach (four continents) including South Korea, Southeast Asia, Middle East (international airport/government), and Latin America.
* **Victims:** A major South Korean electronics manufacturer; an international airport and government agencies in the Middle East; a financial services provider in Latin America.
## Tools & Infrastructure
* **Malware/Tools:**
* **ChromElevator:** A post-exploitation tool for stealing passwords, cookies, and payment info from Chromium browsers.
* **node[dot]exe:** Used as a parent process for the implant chain.
* **Vulnerable Binaries (Abused for Sideloading):**
* fmapp[dot]exe (Fortemedia audio utility)
* sentinelmemoryscanner[dot]exe (SentinelOne security component)
* **Infrastructure:** Public file-transfer services used for exfiltration (defanged URLs: fmapp[dot]dll, sentinelagentcore[dot]dll).
## Implications
This campaign demonstrates Seedworm’s continued focus on strategic intelligence collection to support Tehran’s interests. By targeting high-tech manufacturing and government entities, the group aims to acquire intellectual property and gain "downstream access" via service providers. The use of trusted security software binaries (like SentinelOne) for sideloading indicates an evolving sophistication aimed at bypassing modern EDR/XDR detection and complicating incident response efforts.
## Mitigations
* **Execution Prevention:** Implement strict application control policies to prevent the execution of unauthorized node[dot]exe instances or suspicious binaries in temporary folders.
* **DLL Monitoring:** Enable monitoring for unsigned or unexpected DLLs being loaded by legitimate, signed processes, particularly those known to be abused (e.g., audio drivers or security tools).
* **Credential Protection:** Use Windows Defender Remote Credential Guard and restrict access to the SAM hive to prevent credential dumping.
* **Network Auditing:** Monitor for SOCKS5 tunneling traffic and unusual outbound connections to public file-sharing domains.
* **Endpoint Analysis:** Regularly audit the presence of "paired files" (a signed exe and a local DLL) in unexpected directories.