Daily Briefing for 03.06.26

Top stories.

• Iran’s MuddyWater infiltrates multiple US organizations.
• FBI investigates breach of wiretap management systems.
• Russian national pleads guilty to involvement in the Phobos ransomware operation.

Iran’s MuddyWater infiltrates multiple US organizations.

The Iranian state-sponsored threat actor MuddyWater (also known as "Seedworm" or "Static Kitten") compromised several US entities in early February 2026, including a bank, an airport, US and Canadian non-profits, and the Israeli operations of a US software company, according to researchers at Symantec. The threat actor is using a new backdoor dubbed "Dindoor" and a Python backdoor called "Fakeset."

The activity continued following US and Israeli military strikes on Iran beginning on February 28th. The researchers note, "While it’s not known if the operations of Seedworm are disrupted by the current conflict, already having a presence on US and Israeli networks prior to the current hostilities beginning means the threat group is in a potentially dangerous position to launch attacks." The US government has attributed MuddyWater to Iran's Ministry of Intelligence and Security (MOIS).

FBI investigates breach of wiretap management systems.

The US FBI is investigating a breach of systems used to manage foreign intelligence surveillance and wiretap warrants, CNN reports. A source told CNN that officials are still working to determine the scope of the incident. The source said the incident "has prompted senior officials at the FBI and Justice Department focused on civil liberties and national security to respond." The Bureau said in a statement, "The FBI identified and addressed suspicious activities on FBI networks, and we have leveraged all technical capabilities to respond."

BleepingComputer notes that China's Salt Typhoon cyberespionage operation in 2024 compromised systems used by the US government for court-authorized wiretapping requests, though it's unclear if the latest breach is related.

Russian national pleads guilty to involvement in the Phobos ransomware operation.

A Russian national pleaded guilty in a US Federal court to his involvement in the Phobos ransomware operation, SecurityWeek reports. 43-year-old Evgenii Ptitsyn was arrested in South Korea and extradited to the US in November 2024. The US Justice Department stated, "Each deployment of Phobos ransomware was assigned a unique alphanumeric string to match it to the corresponding decryption key, and each affiliate was directed to pay the decryption key fee to a cryptocurrency wallet unique to the affiliate. From December 2021 to April 2024, the decryption key fees were then transferred from the unique affiliate cryptocurrency wallet to a wallet Ptitsyn controlled. Ptitsyn also received a portion of the ransomware payments made by victims."

Ptitsyn faces a maximum penalty of 20 years in prison for a count of wire fraud conspiracy, with sentencing set for July 15, 2026.