{
  "name": "Iran-Linked Hackers Breached Korean Electronics Maker in Global Spying Campaign",
  "slug": "iran-linked-hackers-breached-korean-electronics-maker-in-global-spying-campaign",
  "description": "Iranian state-sponsored threat group Seedworm conducted a widespread espionage campaign in early 2026, compromising at least nine organizations across nine countries on four continents. Victims included a major South Korean electronics manufacturer, government agencies, an international airport in the Middle East, Southeast Asian industrial manufacturers, a Latin American financial services provider, and educational institutions. The attackers utilized DLL sideloading techniques with legitimately signed Fortemedia and SentinelOne binaries to execute malicious payloads, deployed Node.js-based implants for orchestration, and employed multiple PowerShell scripts for reconnaissance, credential theft, and privilege escalation. Data exfiltration was conducted through public file-transfer service sendit.sh to blend malicious traffic with legitimate cloud services. The campaign demonstrates Seedworm's evolved tradecraft and expanded targeting beyond traditional Middle Eastern focus areas.",
  "published": "2026-05-12T13:58:56.758000+00:00",
  "created_at": "2026-05-12T16:59:54.166000+00:00",
  "modified_at": "2026-05-12T14:59:54+00:00",
  "created_at_opencti": "2026-05-12T16:59:54.166000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "chromelevator",
    "credential-theft",
    "dll-sideloading",
    "espionage",
    "iran",
    "mois",
    "muddywater",
    "seedworm"
  ],
  "tags": [
    "2026-05-12",
    "chromelevator",
    "credential-theft",
    "dll sideloading",
    "espionage",
    "iran",
    "mois",
    "muddywater",
    "seedworm"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "9ff71684-24f0-4403-a4d8-087190b03e29",
        "name": "https://timetrakr.cloud/sp.ps1'"
      },
      {
        "id": "8a1ff82d-3150-4b98-89a4-ec4fb2609cb6",
        "name": "svc.wompworthy.com"
      },
      {
        "id": "1a2b1e43-8022-477c-9787-5213f66c981e",
        "name": "128b58a2a2f1df66c474094aacb7e50189025fbf45d7cd8e0834e93a8fbed667"
      },
      {
        "id": "cc9223f7-24b3-4609-ae0c-6d62e1fc1321",
        "name": "e25892603c42e34bd7ba0d8ea73be600d898cadc290e3417a82c04d6281b743b"
      },
      {
        "id": "c29ed159-8671-4d4a-8296-714d07d2341a",
        "name": "0c9b911935a3705b0ad569446804d80026feb6db3884aeb240b6c76e9b8cf139"
      },
      {
        "id": "441ea8be-b438-47fd-8370-7938090c0332",
        "name": "timetrakr.cloud"
      },
      {
        "id": "60d0bab2-7fd4-4500-8b18-4a743c4525b6",
        "name": "c6182fd01b14d84723e3c9d11bc0e16b34de6607ccb8334fc9bb97c1b44f0cde"
      },
      {
        "id": "e0525b80-63f5-47da-a4d7-81f094406878",
        "name": "74ab3838ebed7054b2254bf7d334c80c8b2cfec4a97d1706723f8ea55f11061f"
      },
      {
        "id": "abf152d8-1e7a-4dd1-a786-1ebe8081bc34",
        "name": "3ee7dab4ae4f6d4f16dfabb6f38faef370411a9fc00ff035844e54703b99600a"
      },
      {
        "id": "fc61302d-1e64-4c66-a2e7-18979dcaee7f",
        "name": "bee79c3302b1a7afc0952842d14eff83a604ef00bfdae525176c16c80b2045f7"
      },
      {
        "id": "164efa63-e095-4585-9e11-c9e50b4af5c3",
        "name": "b21c802775df0c0d82c8cfde299084abc624898b10258db641b820172a0ba29a"
      },
      {
        "id": "9618682e-93de-485d-92a7-66049e631427",
        "name": "d587959841a763669279ad831b8f0379f6a7b037dffc19deab5d41f37f8b5ffc"
      },
      {
        "id": "0cf1ac7d-3451-4fe4-9214-ae7d799a644d",
        "name": "https://svc.wompworthy.com"
      }
    ],
    "intrusion_sets": [
      {
        "id": "98b7af71-8465-4bc4-9526-3bd1a8ac5f59",
        "name": "MuddyWater",
        "slug": "muddywater"
      }
    ],
    "attack_patterns": [
      {
        "id": "9e6c4b38-f4e1-4b1f-b90a-222f881acbab",
        "name": "T1087.002"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "02abb0a8-0ebf-433b-987f-e25675af60d6",
        "name": "T1055.001"
      },
      {
        "id": "adac40c7-ef36-4a03-af99-079bc834463a",
        "name": "T1003.002"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "e615d5ec-8d67-4048-b21d-a5fb09925bb9",
        "name": "T1552.001"
      },
      {
        "id": "64cdebc9-0fb4-48f2-bf4f-b87f3741f664",
        "name": "T1068"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "880d45b0-e336-4f1a-8893-2796195f5500",
        "name": "T1543.001"
      },
      {
        "id": "14e5fcd9-c0ff-44f0-8430-d8942ebb832e",
        "name": "T1567.002"
      },
      {
        "id": "e6c0ca23-78ee-4b0e-96fa-e80efab3665d",
        "name": "T1003.001"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "36d26fbc-439e-460e-bb28-0935ad0c1b8a",
        "name": "T1090.001"
      },
      {
        "id": "a6b6df0a-93c1-4ddf-8403-2bc47590f9fe",
        "name": "T1087.001"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "ccb28547-a340-4193-a5d9-69222f3d5051",
        "name": "T1049"
      },
      {
        "id": "d5c953ff-b143-41b6-bf2d-87b829132ea5",
        "name": "T1135"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "fe0fdce2-cd87-4ac3-9a7c-1231d72aecc3",
        "name": "chromelevator",
        "slug": "chromelevator"
      }
    ],
    "observables": [
      {
        "id": "0af0c332-4025-46c7-9253-156819e6adff",
        "name": "timetrakr.cloud"
      },
      {
        "id": "b9c635c3-67ce-46c0-8cf5-deadc9367802",
        "name": "svc.wompworthy.com"
      },
      {
        "id": "36c13da4-6c49-43f5-9785-0279d82d2983",
        "name": "https://svc.wompworthy.com"
      },
      {
        "id": "b8a8174d-7040-4ba3-9aad-baa5ee85d42c",
        "name": "https://timetrakr.cloud/sp.ps1'"
      },
      {
        "id": "",
        "name": "128b58a2a2f1df66c474094aacb7e50189025fbf45d7cd8e0834e93a8fbed667"
      },
      {
        "id": "",
        "name": "e25892603c42e34bd7ba0d8ea73be600d898cadc290e3417a82c04d6281b743b"
      },
      {
        "id": "",
        "name": "0c9b911935a3705b0ad569446804d80026feb6db3884aeb240b6c76e9b8cf139"
      },
      {
        "id": "",
        "name": "c6182fd01b14d84723e3c9d11bc0e16b34de6607ccb8334fc9bb97c1b44f0cde"
      },
      {
        "id": "",
        "name": "74ab3838ebed7054b2254bf7d334c80c8b2cfec4a97d1706723f8ea55f11061f"
      },
      {
        "id": "",
        "name": "3ee7dab4ae4f6d4f16dfabb6f38faef370411a9fc00ff035844e54703b99600a"
      },
      {
        "id": "",
        "name": "bee79c3302b1a7afc0952842d14eff83a604ef00bfdae525176c16c80b2045f7"
      },
      {
        "id": "",
        "name": "b21c802775df0c0d82c8cfde299084abc624898b10258db641b820172a0ba29a"
      },
      {
        "id": "",
        "name": "d587959841a763669279ad831b8f0379f6a7b037dffc19deab5d41f37f8b5ffc"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Brazil"
      },
      {
        "id": "",
        "name": "United Arab Emirates"
      },
      {
        "id": "",
        "name": "Qatar"
      },
      {
        "id": "",
        "name": "Saudi Arabia"
      },
      {
        "id": "",
        "name": "Kuwait"
      },
      {
        "id": "",
        "name": "Colombia"
      },
      {
        "id": "",
        "name": "Philippines"
      },
      {
        "id": "",
        "name": "Chile"
      },
      {
        "id": "",
        "name": "Malaysia"
      },
      {
        "id": "",
        "name": "Singapore"
      },
      {
        "id": "",
        "name": "Argentina"
      },
      {
        "id": "",
        "name": "Oman"
      },
      {
        "id": "",
        "name": "Mexico"
      },
      {
        "id": "",
        "name": "Indonesia"
      },
      {
        "id": "",
        "name": "Bahrain"
      },
      {
        "id": "",
        "name": "Thailand"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Education"
      },
      {
        "id": "",
        "name": "Manufacturing"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "High-tech"
      },
      {
        "id": "",
        "name": "Transportation"
      },
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "svc.wompworthy.com"
      },
      {
        "id": "",
        "name": "timetrakr.cloud"
      }
    ]
  },
  "external_refs": [
    {
      "id": "4c063952-d7b3-4876-a0be-d9bce2b77f96",
      "standard_id": "external-reference--9e0a968a-5596-5a78-bcbc-4fa61c39bfeb",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.security.com/threat-intelligence/iran-seedworm-electronics",
      "hash": null,
      "external_id": null,
      "created": "2026-05-12T16:59:45.533Z",
      "modified": "2026-05-12T16:59:45.533Z",
      "createdById": null
    },
    {
      "id": "0b3dd5f0-a797-4436-871b-b5eda8f57d25",
      "standard_id": "external-reference--f8a757e2-a300-5572-9dfa-08f924a10608",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a033220a0063c7c2a4f1d8f",
      "hash": null,
      "external_id": "6a033220a0063c7c2a4f1d8f",
      "created": "2026-05-12T16:59:45.502Z",
      "modified": "2026-05-12T16:59:45.502Z",
      "createdById": null
    }
  ]
}