Iran-Linked MuddyWater Abuses Deno Runtime for Dindoor Backdoor Deployment
Iranian threat group MuddyWater is leveraging the legitimate Deno JavaScript runtime to execute its Dindoor backdoor, employing Base64 encoding and anti-analysis techniques to evade detection.
An Iran-linked threat actor known as MuddyWater is employing a sophisticated tactic to evade security defenses by abusing the legitimate Deno JavaScript and TypeScript runtime to execute its Dindoor backdoor. This method allows the malware's activity to blend seamlessly with normal software operations, making detection significantly more challenging.
Dindoor has been observed as a later-stage payload in targeted spearphishing campaigns, with researchers identifying its presence in attacks against software and banking organizations in the United States, as well as a non-profit entity in Canada. This broad targeting across critical sectors underscores the group's reach and intent.
Security analysts at Binary Defense, who began tracking the backdoor in early 2026, noted that Dindoor combines several evasion techniques. These include the use of a signed runtime, Base64 encoding of malicious code, and specific checks designed to thwart analysis. This multi-layered approach avoids relying on a single, easily identifiable malicious executable, instead transforming familiar Windows utilities and the Deno runtime into components of a dangerous delivery chain.
The infection process typically begins after an initial phishing stage successfully deploys a loader onto a victim's system. The loader then checks for the presence of the Deno runtime. If Deno is not installed, the malware uses the curl utility to download it from the official repository before launching it with a lengthy Base64-encoded argument containing the Dindoor payload. This strategy leverages Deno's legitimate status and digital signature as a cover.
Once executed, the initial Deno script gathers information about the compromised host and establishes communication with a remote command-and-control (C2) server. It then proceeds to compile and execute a second-stage payload, which in turn retrieves and runs a third stage. This layered execution chain complicates investigations and provides the attackers with flexibility to modify later components without altering the initial infection vector.
Before establishing persistence, the final stage of Dindoor performs a crucial anti-analysis check. It queries the system's graphics adapter using PowerShell's Windows Management Instrumentation (WMI). If the query reveals names associated with virtual machine environments like VMware, VirtualBox, or Hyper-V, the malware aborts its execution, preventing its behavior from being analyzed in a sandbox. Only after passing this check does Dindoor establish persistence by creating a Windows Run registry entry that launches a VBScript via wscript.exe upon user login.
Detection of Dindoor requires a shift from traditional signature-based methods to behavioral analysis. The malware's network communications utilize Deno's listen function for TCP connections, with data encoded in Base64. Given that the tools used are legitimate and signed, defenders should focus on hunting for specific sequences of activity. Key indicators include Deno being launched with unusually long encoded arguments, curl contacting the Deno download domain on non-developer systems, and a Run registry key pointing wscript.exe to a script located in the user's AppData directory. Additionally, monitoring for PowerShell WMI queries related to graphics adapters, especially when preceding new persistence mechanisms, is critical.
The campaign highlights the persistent effectiveness of spearphishing as an entry point for espionage groups. Organizations are advised to bolster user reporting mechanisms, implement robust controls for inspecting email attachments and links, and conduct rapid endpoint reviews following suspicious message delivery. By focusing on the assembly of trusted software, encoded scripts, anti-analysis checks, and stealthy persistence, MuddyWater aims to maintain access with minimal detection, posing a significant threat to targeted entities.