TLDR Tech / InfoSec
Threat Intelligence Report: MANGO SANDSTORM Dindoor / Fakeset Campaign
MuddyWater (MANGO SANDSTORM/MERCURY) conducted an espionage campaign in February against a US financial institution, a US airport, a Canadian non-profit, and an Israeli defense software subsidiary using Dindoor, a Deno runtime backdoor chosen specifically to evade PowerShell/Python-tuned detection logic, alongside the Python-based Fakeset implant linked to prior Stagecomp and Darkcomp certificate lineage (T1059, T1566, T1567, T1105, and T1071). Rclone exfiltrated data to Wasabi cloud storage while staging infrastructure leveraged Backblaze B2, deno.land, and Cloudflare-fronted domains including uppdatefile[.]com, serialmenot[.]com, and moonzonet[.]com to blend C2 traffic within legitimate enterprise cloud activity. Defenders should prioritize detecting Deno runtime execution in non-development environments, anomalous Rclone invocations outside sanctioned backup workflows, and outbound traffic to commodity cloud storage, as the absence of traditional static IOCs is itself a deliberate operational characteristic of this campaign.
Read the full story