Top stories.
- Iran’s MuddyWater infiltrates multiple US organizations.
- FBI investigates breach of wiretap management systems.
- Russian national pleads guilty to involvement in the Phobos ransomware operation.
Iran’s MuddyWater infiltrates multiple US organizations.
The Iranian state-sponsored threat actor MuddyWater (also known as "Seedworm" or "Static Kitten") compromised several US entities in early February 2026, including a bank, an airport, US and Canadian non-profits, and the Israeli operations of a US software company, according to researchers at Symantec. The threat actor is using a new backdoor dubbed "Dindoor" and a Python backdoor called "Fakeset."
The activity continued following US and Israeli military strikes on Iran beginning on February 28th. The researchers note, "While it’s not known if the operations of Seedworm are disrupted by the current conflict, already having a presence on US and Israeli networks prior to the current hostilities beginning means the threat group is in a potentially dangerous position to launch attacks." The US government has attributed MuddyWater to Iran's Ministry of Intelligence and Security (MOIS).

