Cybersecurity experts have raised alarms over growing cyber threats from Iran-linked hacker groups targeting critical infrastructure and strategic organizations in the United States. Recent attacks, attributed to the long-standing threat actor Seedworm—also known as MuddyWater, Temp Zagros, and Static Kitten—have focused on U.S. banks, airports, software companies with Israeli operations, and nonprofit organizations in North America.
According to reports, the malicious activity began in February 2026 and has continued into recent weeks. Analysts note that the timing of the attacks coincides with heightened military and geopolitical tensions involving Iran, the United States, and Israel. This overlap has prompted concerns that compromised networks could be leveraged in future operations aimed at espionage, disruption, or sabotage.
One of the significant findings in the ongoing investigations is the emergence of a previously unknown backdoor called Dindoor. This malware was detected on the network of the Israeli branch of a U.S.-based software company. Further analysis revealed Dindoor on systems belonging to a U.S. bank and a Canadian non-profit organization. The backdoor operates using Deno, the JavaScript and TypeScript runtime environment, and is signed with a certificate issued to “Amy Cherne.” Researchers caution that Dindoor provides attackers with covert access to compromised networks, enabling them to execute commands, exfiltrate sensitive information, and potentially disrupt operations.
In addition to Dindoor, cybersecurity teams discovered another malicious tool named Fakeset, a Python-based backdoor present on the systems of a U.S. airport and a non-profit organization. Fakeset appears designed for stealthy access and persistent network compromise. The simultaneous use of multiple malware tools highlights the sophistication and versatility of Seedworm’s campaigns.
Analysts emphasize that the attacks are not limited to a single sector. By targeting critical infrastructure and strategic organizations, the hackers aim to gain access to sensitive operational and financial data. Experts warn that such access could facilitate future disruptive attacks, intelligence-gathering operations, or ransomware-style actions.
The use of open-source programming environments such as Deno and Python for backdoor development indicates a shift towards more flexible and difficult-to-detect malware. This approach allows threat actors to bypass conventional security measures and maintain long-term persistence within networks.
Security researchers are urging organizations to enhance monitoring, implement robust endpoint protection, and maintain up-to-date threat intelligence to mitigate risks from Iran-linked cyber activity. Regular security audits, network segmentation, and employee awareness training are also recommended to reduce exposure to potential intrusions.
The recent surge in cyber operations by Seedworm underscores the growing importance of cybersecurity for critical infrastructure and strategic sectors. With the geopolitical situation in West Asia remaining volatile, organizations across the United States and allied countries are being advised to adopt proactive defensive measures to counter potential attacks and secure sensitive information.
