Seedworm APT Abuses Signed Fortemedia and SentinelOne Binaries for DLL Sideloading
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Iran-linked hackers have been quietly breaking into networks around the world, and their latest campaign is more calculated than anything we have seen from them before. <\/p>\n
The group known as Seedworm, also tracked as MuddyWater<\/a>, spent the first quarter of 2026 targeting at least nine organizations across nine countries on four continents, leaving a trail of stolen data and compromised credentials.<\/a><\/p>\n The targets ranged widely, touching industrial and electronics manufacturing firms, educational institutions, government agencies, financial services providers, and even an international airport in the Middle East. <\/p>\n One of the most striking intrusions took place in February 2026, when the group spent a full week inside the network of a major South Korean electronics manufacturer, a region far outside its traditional hunting ground.<\/a><\/p>\n Analysts from Symantec\u2019s Threat Hunter Team identified the campaign<\/a> and linked it to Seedworm, a group widely believed to operate on behalf of Iran\u2019s Ministry of Intelligence and Security. <\/p>\n The researchers noted that every targeted organization likely held information of direct intelligence value to Tehran, whether that was intellectual property, government data, or access to downstream customers.<\/a><\/a><\/p>\n What stands out is not just the range of victims, but how the attackers moved through their targets. Rather than relying on noisy, easily detected methods, Seedworm showed a level of operational discipline that signals real maturity in its tradecraft. The attackers blended their techniques to stay hidden, move quietly, and extract data without triggering obvious alarms.<\/a><\/p>\n The group also updated its tooling, mixing familiar tools with new delivery methods and choosing exfiltration paths that are harder to detect. This campaign is a clear reminder that state-linked espionage actors are constantly refining their approach, and defenders need to stay ahead.<\/p>\n The most striking technique in this campaign was how the attackers turned trusted software against the organizations it was supposed to protect. They dropped pairs of files on targeted systems: one legitimate, signed executable, and one malicious DLL crafted to be secretly loaded by it.<\/a><\/p>\n The first pair used fmapp.exe, a legitimate audio-driver utility, to load a malicious file called fmapp.dll. The second pair was more provocative: sentinelmemoryscanner.exe, a legitimate component from a well-known security product<\/a>, was used to sideload a malicious file called sentinelagentcore.dll. By sheltering behind trusted, signed software, the attackers made their activity look benign at a glance, defeating both path-based and signature-based detection.<\/a><\/p>\n Both malicious DLLs carried ChromElevator, a post-exploitation tool<\/a> capable of stealing passwords, cookies, and payment card data from Chromium-based browsers. In every observed case, the parent process launching these files was node.exe, meaning a Node.js script was driving the entire sideloading chain rather than a human operator at a keyboard.<\/a><\/p>\n Once inside a network, the attackers wasted no time collecting credentials and locking in their access. They used registry changes to ensure their loader chain would restart every time the affected user logged in. They also dumped Windows registry hives containing password hashes, giving them offline material for cracking and lateral movement.<\/a><\/p>\n Multiple credential-theft tools were deployed in rapid succession, showing the attackers wanted redundancy in case any single method was caught. One tool triggered a fake Windows login prompt to harvest a password and saved it to a plaintext file on disk. Another automated Kerberos ticket extraction without ever needing a domain administrator\u2019s password.<\/a><\/p>\n For exfiltration, the group used sendit[.]sh, a public file-transfer service, to move stolen files off the network. Routing data through a consumer cloud platform is a deliberate tactic to blend malicious traffic<\/a> with ordinary internet activity. Organizations should monitor for unexpected use of public file-sharing services and audit all outbound transfers from sensitive directories.<\/a><\/p>\n Defenders should also watch for unusual node.exe process trees, unexpected DLL loads from signed third-party binaries, and PowerShell pulling content from external staging servers. Keeping endpoint detection rules current and reviewing registry run keys regularly can reduce the window attackers have to maintain their foothold.<\/a><\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/p>\n Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em> Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post Seedworm APT Abuses Signed Fortemedia and SentinelOne Binaries for DLL Sideloading<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nAbusing Signed Binaries for DLL Sideloading<\/strong><\/h2>\n
Credential Theft, Exfiltration, and Defensive Steps<\/strong><\/h2>\n
\n\n
\n \nType<\/th>\n Indicator<\/th>\n Description<\/th>\n<\/tr>\n<\/thead>\n \n SHA256<\/td>\n e25892603c42e34bd7ba0d8ea73be600d898cadc290e3417a82c04d6281b743b<\/td>\n fmapp.exe (legitimate sideloading binary)<\/td>\n<\/tr>\n \n SHA256<\/td>\n c6182fd01b14d84723e3c9d11bc0e16b34de6607ccb8334fc9bb97c1b44f0cde<\/td>\n fmapp.dll (malicious sideloaded DLL)<\/td>\n<\/tr>\n \n SHA256<\/td>\n 128b58a2a2f1df66c474094aacb7e50189025fbf45d7cd8e0834e93a8fbed667<\/td>\n sentinelmemoryscanner.exe (legitimate sideloading binary)<\/td>\n<\/tr>\n \n SHA256<\/td>\n 0c9b911935a3705b0ad569446804d80026feb6db3884aeb240b6c76e9b8cf139<\/td>\n sentinelagentcore.dll (malicious sideloaded DLL)<\/td>\n<\/tr>\n \n SHA256<\/td>\n 74ab3838ebed7054b2254bf7d334c80c8b2cfec4a97d1706723f8ea55f11061f<\/td>\n Privilege escalation tool<\/td>\n<\/tr>\n \n SHA256<\/td>\n 3ee7dab4ae4f6d4f16dfabb6f38faef370411a9fc00ff035844e54703b99600a<\/td>\n SAM hive credential extractor<\/td>\n<\/tr>\n \n SHA256<\/td>\n bee79c3302b1a7afc0952842d14eff83a604ef00bfdae525176c16c80b2045f7<\/td>\n SAM hive credential extractor<\/td>\n<\/tr>\n \n SHA256<\/td>\n d587959841a763669279ad831b8f0379f6a7b037dffc19deab5d41f37f8b5ffc<\/td>\n Credential harvester<\/td>\n<\/tr>\n \n SHA256<\/td>\n b21c802775df0c0d82c8cfde299084abc624898b10258db641b820172a0ba29a<\/td>\n SOCKS5 proxy tool<\/td>\n<\/tr>\n \n IP Address<\/td>\n 179.43.177[.]220<\/td>\n Attacker-controlled staging server<\/td>\n<\/tr>\n \n IP Address<\/td>\n 178.128.233[.]36<\/td>\n Network IOC<\/td>\n<\/tr>\n \n IP Address<\/td>\n 172.67.156[.]47<\/td>\n Network IOC<\/td>\n<\/tr>\n \n IP Address<\/td>\n 104.21.48[.]205<\/td>\n Network IOC<\/td>\n<\/tr>\n \n IP Address<\/td>\n 37.187.78[.]41<\/td>\n Network IOC<\/td>\n<\/tr>\n \n IP Address<\/td>\n 34.117.59[.]81<\/td>\n Network IOC<\/td>\n<\/tr>\n \n Domain<\/td>\n timetrakr[.]cloud<\/td>\n Attacker-owned staging domain<\/td>\n<\/tr>\n \n Domain<\/td>\n sendit[.]sh<\/td>\n Public file-transfer service used for exfiltration<\/td>\n<\/tr>\n \n Domain<\/td>\n svc.wompworthy[.]com<\/td>\n Network IOC<\/td>\n<\/tr>\n \n URL<\/td>\n http:\/\/179.43.177[.]220:8080\/nm.ps1<\/td>\n PowerShell payload download URL<\/td>\n<\/tr>\n \n URL<\/td>\n http:\/\/179.43.177[.]220:8080\/a.dat<\/td>\n Encoded payload download URL<\/td>\n<\/tr>\n \n URL<\/td>\n http:\/\/179.43.177[.]220:8080\/a.exe<\/td>\n Binary download URL<\/td>\n<\/tr>\n \n URL<\/td>\n http:\/\/ipinfo[.]io\/json<\/td>\n Used to identify host\u2019s public IP<\/td>\n<\/tr>\n \n URL<\/td>\n https:\/\/svc.wompworthy[.]com<\/td>\n Network IOC<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n [.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n