Threats & Adversaries · DDoS

Iran-linked MuddyWater hackers target U.S. networks with new dindoor backdoor

Following coordinated US-Israeli military strikes (Operation Epic Fury/Roaring Lion), Iran-aligned and pro-West threat actors have increased cyber operations. Verify and enable DDoS protection with your CDN/provider (e.g., Cloudflare/Akamai), segment and isolate OT/ICS networks, and deploy EDR detections and alerts.

18 sources · Mar 24

Timeline

• Mar 24 Reported by The Record from Recorded Future
• Mar 24 Reported by Cybersecurity Dive
• Mar 19 Reported by CyberScoop
• Mar 18 Reported by Tenable
• Mar 16 Reported by Unit 42
• Mar 13 Reported by ESET Research
• Mar 12 Reported by Dark Reading
• Mar 11 Reported by Rapid7
• Mar 10 Reported by Check Point Research
• Mar 6 Reported by The Hacker News
• Mar 5 Reported by Schneier on Security
• Mar 3 Reported by TechCrunch Security

Sources

• Mar 24 The Record from Recorded Future

  Iran-linked ransomware gang targeted US healthcare org amid military conflict

  The incident responders noted that there was no evidence that data was exfiltrated during the intrusion — an unusual development considering U.S. intelligence agencies previously said Pay2Key attacks were largely conducted for information theft.

  original

• Mar 24 Ars Technica Security

  Self-propagating malware poisons open source software and wipes Iran-based machines

  Development houses: It's time to check your networks for infections.

  original

• Mar 24 SecurityWeek

  Stryker Says Malicious File Found During Probe Into Iran-Linked Attack

  The FBI has published an alert describing the malware used by Iranian government hackers.

  original

Part of the PlainSec briefing for 2026-03-08

Every edition of this story: Iran-linked MuddyWater hackers target U.S. networks with new dindoor backdoor

More from today

• Velvet Tempest stages DonutLoader and CastleRAT via ClickFix campaign