An Iranian-linked hacker group has been leveraging a legitimate developer tool to obscure a backdoor known as Dindoor within Windows operating systems. This tactic, which utilizes the Deno JavaScript and TypeScript runtime, allows the malware to operate under the guise of standard software processes.
Concealed Operations in Various Sectors
Dindoor has been deployed as a subsequent payload in targeted spearphishing attacks. Its presence has been detected in U.S. software and banking firms, as well as a Canadian non-profit, indicating its broad reach across multiple industries. The cybersecurity firm Binary Defense has been tracking this backdoor since early 2026, attributing the activity to the Iranian threat group known as MuddyWater.
According to a report shared with Cyber Security News, Dindoor’s approach combines a signed runtime and Base64 encoding, effectively evading traditional analysis. This method doesn’t rely on a single suspicious executable, but rather integrates familiar Windows utilities and a legitimate runtime to create a seemingly harmless delivery chain.
Detailed Infection Process
The infection process begins with a phishing attack that installs a loader on the target device. If the Deno runtime is not present, the malware uses the curl utility to download it, subsequently launching it with a Base64-encoded argument containing the Dindoor code. This installation, though not inherently suspicious, warrants scrutiny on non-developer systems, especially after phishing or unusual script activities.
The initial script executed by Dindoor gathers data from the compromised host and communicates with a remote server to compile a secondary payload. This payload retrieves and executes a third stage, creating a complex chain that complicates investigation and allows operators to modify components as needed.
Countermeasures and Detection Strategies
To establish persistence, Dindoor uses a Windows Run registry entry to launch a VBScript with wscript upon user login. This multi-stage tactic resembles previous strategies used by MuddyWater, designed to minimize visibility and maintain access.
Detection efforts must focus on behavior rather than static indicators. High-value signs include the execution of Deno with an unusually long encoded argument, unexpected curl activity, and registry entries pointing wscript to scripts in the AppData Local directory. Additionally, PowerShell queries for graphics adapters, indicative of virtual environments, should prompt further investigation.
Organizations can reduce their exposure by monitoring Deno usage, alerting on unauthorized downloads, and correlating phishing incidents with process and registry telemetry during routine endpoint reviews. Implementing these measures emphasizes the importance of user reporting and rapid endpoint assessments following suspicious communications.
In conclusion, while Dindoor may not introduce entirely new techniques, its combination of trusted software, encoded scripts, and strategic system checks creates a potent threat that could help MuddyWater maintain access with minimal detection risk.
