MuddyWater-linked threat actors are using a backdoor named Dindoor that abuses the legitimate Deno runtime to execute malicious code and evade security detection.
Researchers at Binary Defense began tracking Dindoor in early 2026 after finding infections at U.S. software and banking organizations, as well as a Canadian non-profit. The malware is associated with the Iranian APT group MuddyWater.
Dindoor does not rely on a custom interpreter. Instead, it uses Deno, a signed and widely used JavaScript and TypeScript runtime. If Deno is not already installed, the malware downloads it from deno.land using curl.exe.
This approach helps Dindoor blend into normal activity. Security products may trust Deno because it is a legitimate developer tool, while the malware hides its scripts in Base64-encoded arguments.
Dindoor Abuses Deno Runtime
Dindoor is mainly delivered as a later-stage payload in spearphishing attacks. Once the attackers gain initial access, the loader checks whether Deno exists on the compromised Windows system. It then launches Deno with a Base64-encoded script containing the backdoor.
The attack chain contains three payload stages. The first stage fingerprints the infected device, contacts a command-and-control server, and compiles a secondary payload. That payload retrieves and executes the final stage from the remote server.
Before enabling its main functions, the final payload checks whether it is running inside a virtual machine or automated malware-analysis sandbox. It launches PowerShell through cmd.exe and queries the Win32_VideoController WMI class.
The query collects the name of the installed graphics adapter. Virtualized environments often expose identifiable adapter names, including VMware SVGA, VirtualBox, QXL, or Hyper-V display drivers.
If Dindoor detects one of these environments, it stops. This makes sandbox analysis harder because investigators may observe only the PowerShell WMI query rather than the full attack chain.
On systems that appear to be genuine user devices, Dindoor creates persistence through a Windows Run registry key. The key launches wscript.exe to execute a VBScript stored under the user’s AppData Local directory.
The observed persistence command launches a file named Lynx_system59.vbs from a Serial subdirectory. Because persistence happens only after the virtual-machine check, sandboxes may never capture this important behavior.
For command-and-control activity, Dindoor uses Deno’s listen function to create a TCP listener. The malware Base64-encodes communication data, continuing the same obfuscation method used throughout its execution chain.
Dindoor uses several legitimate Windows and developer tools, including curl.exe, deno.exe, wscript.exe, and PowerShell. All are signed binaries that can appear normal when viewed in isolation. As a result, static hashes and signature-based detection may miss newly encoded Dindoor variants, binarydefense said.
Dindoor shows how MuddyWater can combine familiar techniques with trusted software to reduce detection. The individual methods are not new, but using Deno as a malware execution engine gives the group a flexible and legitimate-looking way to run malicious code.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
