Iran-Linked Hackers Abuse Legitimate Developer Tool to Hide Dindoor Backdoor

Iran-linked operators are using a trusted developer tool to conceal a backdoor called Dindoor inside Windows environments.

The malware uses the Deno JavaScript and TypeScript runtime to execute encoded code, helping its activity blend into legitimate software use.

Dindoor has appeared as a later-stage payload in spearphishing intrusions. Researchers observed it at U.S. software and banking organizations and at a Canadian non-profit, demonstrating its reach across different sectors.

Analysts at Binary Defense began tracking the backdoor in early 2026 and linked the activity to MuddyWater, an Iranian threat group. 

Binary Defense said in a report shared with Cyber Security News (CSN) that Dindoor combines a signed runtime, Base64 encoding, and checks that evade analysis.

The approach matters because it does not rely on one unusual executable to block. Instead, it turns familiar Windows utilities and a legitimate runtime into parts of one delivery chain, making legitimate-looking activity dangerous in the wrong context.

Iran-Linked Hackers Abuse Legitimate Developer Tool

The infection begins after an earlier phishing stage places its loader on a device. It checks whether Deno is already installed; if not, it uses curl to obtain the runtime, then launches it with a long Base64-encoded argument containing the Dindoor code.

That decision gives the operators a useful cover story. Deno is signed software used to run JavaScript and TypeScript, so its presence is not automatically suspicious.

Yet an unexpected installation on a non-developer workstation deserves attention after phishing or unusual script activity.

The first script gathers information about the compromised host, opens communications with a remote server, and compiles a second payload.

That second stage retrieves and runs a third stage, creating a layered chain that can complicate investigation and lets the operators change later components.

The final stage first checks the machine’s graphics adapter through a PowerShell Windows Management Instrumentation query.

Names associated with VMware, VirtualBox, QXL, or Hyper-V can reveal a virtual or automated analysis system, allowing the malware to stop before exposing its more harmful behavior.

Only after this test does Dindoor establish persistence. It creates a Windows Run registry entry that launches a VBScript through wscript, so the backdoor can return when the user signs in.

This staged approach resembles custom malware multi-stage payloads previously used by MuddyWater to limit visibility and sustain access.

Detection Must Follow Behavior

Dindoor’s network communications use Deno’s listen function to create a TCP listener, while the data is Base64-encoded to hide its contents. The tools are legitimate and signed, so a file hash or static signature may only catch a known version.

Defenders should therefore hunt for the sequence, not merely a suspicious file. High-value signals include Deno launched with an unusually long encoded argument, curl contacting the Deno download domain on systems with no development role, and a Run key pointing wscript to a script below AppData Local.

Teams should also investigate a PowerShell graphics-adapter query launched by cmd, especially when it precedes new persistence.

This focus on behavior supports lessons from the earlier PhonyC2 command framework, where tracking a group’s changing methods was more useful than relying on a single tool name.

Teams can reduce exposure by reviewing Deno use, alerting on unapproved downloads, and correlating phishing reports with process and registry telemetry during routine endpoint reviews.

They should validate installations and restrict script execution where business use does not justify it. The campaign also reinforces why spearphishing remains a practical entry point for espionage groups.

Organizations should pair user reporting with controls that inspect attachments and links, and review endpoints quickly after suspicious messages, as seen in legitimate remote administration tools campaigns attributed to the same actor.

Dindoor is not defined by a wholly new technique. Its risk lies in careful assembly: trusted software, encoded scripts, a check for analysis systems, and persistence that activates only on a likely real victim.

That combination may help MuddyWater keep access while leaving fewer obvious clues for conventional defenses.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Iran-Linked Hackers Abuse Legitimate Developer Tool to Hide Dindoor Backdoor appeared first on Cyber Security News.