TLDR Tech / InfoSec
Seedworm APT Abuses Signed Fortemedia and SentinelOne Binaries for DLL Sideloading
Iran-linked Seedworm (MuddyWater) ran an early-2026 espionage campaign that targeted nine organizations across nine countries, abusing legitimate Fortemedia (fmapp.exe) and SentinelOne (sentinelmemoryscanner.exe) binaries to sideload malicious DLLs containing the ChromElevator browser-data stealer. The operators orchestrated the chain via node.exe rather than PowerShell to evade detection, established registry-key persistence, deployed credential theft tools in redundant waves, and exfiltrated data via the public file-transfer service sendit[.]sh to blend into normal cloud traffic. Defenders should monitor for unsigned DLLs loaded alongside signed executables, flag unexpected Node.js activity, block outbound traffic to unknown file-transfer services, and enforce strict startup registry policies.
Read the full story