Two Countries, Three Backdoors, One Weekend: Iran and China Got Busy

The Short Version

This weekend, two nation-state hacking groups dropped new malware on critical infrastructure. Iran hit US banks and airports. China hit South American phone companies. We indexed everything.

Iran: MuddyWater's New Toys

**Who**: MuddyWater (aka Seedworm). Iranian government hackers working for the Ministry of Intelligence.

**What they hit**: A US bank. An airport. Defense contractors. Nonprofits.

**How**: Two brand-new backdoors nobody had seen before:

- **Dindoor** — Built on Deno, a JavaScript runtime. Think of it like this: instead of bringing a lockpick, they brought their own door. The antivirus is looking for lockpicks. It doesn't know what Deno is. That's the trick.

- **Fakeset** — A Python script that phones home to Backblaze (a cloud storage company). Your firewall sees traffic to a legitimate cloud service and waves it through.

Both were digitally signed with fake certificates under the names "Amy Cherne" and "Donald Gay." The "Donald Gay" cert was previously used to sign other MuddyWater malware. That's how Symantec connected the dots.

**The sloppy part**: They used Rclone (a file-syncing tool) to steal data and dump it into a Wasabi cloud bucket. Rclone is a legitimate tool — IT departments use it every day. That's the whole point. Hide in plain sight.

**What we published**: 5 CVEs they're actively exploiting, mostly in Hikvision and Dahua security cameras. If you have Chinese-made cameras on your network, patch them yesterday.

China: UAT-9244's Telecom Takeover

**Who**: UAT-9244. Chinese state hackers with ties to FamousSparrow and possibly Salt Typhoon (the group that was inside US telecoms last year).

**What they hit**: Phone companies in South America. The infrastructure that carries your calls.

**How**: Three custom tools, one for each job:

- **TernDoor** (Windows) — Gets in through DLL side-loading. They abuse a legitimate program called `wsprint.exe` to load their malicious `BugSplatRc64.dll`. Windows trusts the legitimate program. The legitimate program loads the malware. Game over.

- **PeerTime** (Linux) — Uses BitTorrent for command-and-control. Your network sees BitTorrent traffic and thinks someone's downloading movies. It's actually a backdoor talking to Beijing. Runs on ARM, MIPS, PowerPC — basically anything with a chip.

- **BruteEntry** (Edge devices) — Written in Go. Sits on routers and network equipment, brute-forces SSH and PostgreSQL passwords, and turns compromised devices into proxy nodes. Your router becomes part of China's attack infrastructure.

**The infrastructure**: 24 IP addresses across Vultr, Kaopu Cloud HK (Lightnode), SC Global Data, and Cogent. Four IPs in the same /24 block on Kaopu — they rented a chunk. One IP (185.196.10.38) has a PTR record of `RDP-CWSzwvQS` — somebody left their RDP server name in the DNS. Sloppy.

**What we published**: 24 IPs, 3 domains, 42 file hashes. Everything Cisco Talos found, enriched with PTR records and VirusTotal reputation data.

Why This Matters

Two separate countries. Two separate campaigns. Same week. Same playbook: target critical infrastructure, use legitimate tools to hide, steal everything.

The difference between reading about this and doing something about it is having the IOCs in your firewall. We published both sets — free, in our STIX feed and on OTX.

The Feeds

- **UAT-9244 OTX Pulse**: [69 indicators](https://otx.alienvault.com/pulse/69aed6464de7a8689b02a06a) — 24 IPs, 3 domains, 42 SHA256 hashes

- **MuddyWater OTX Pulse**: [5 CVEs](https://otx.alienvault.com/pulse/69aed5a4fef4564e854b99d7) — Hikvision/Dahua vulns under active exploitation

- **STIX Feed**: [analytics.dugganusa.com/api/v1/stix-feed](https://analytics.dugganusa.com/api/v1/stix-feed) — 275+ consumers in 46 countries. Free.

Your threat feed should already have these. If it doesn't, you're paying too much for the wrong feed.

---

*Her name was Renee Nicole Good.*

*His name was Alex Jeffery Pretti.*