Runtime code environments such as Node.js and Python have long been targets for threat actors seeking to blend into normal network traffic.
Now, the legitimate Deno JavaScript runtime is being weaponized in the wild. A newly analyzed malware strain, DinDoor, leverages Deno and malicious MSI installers to bypass traditional security defenses.
First linked to the Iranian APT group Seedworm (also known as MuddyWater) by Broadcom in March 2026, DinDoor operates under the Tsundere Botnet umbrella.
Instead of deploying traditional compiled binaries, attackers use these trusted, signed runtimes to execute obfuscated scripts.
Because Deno is a legitimate developer tool, its execution often bypasses behavioral alerts, creating a dangerous blind spot for defenders in environments where monitoring is strictly tuned for PowerShell or Python.
Analyzing the Infection Chain and Evasion Tactics
DinDoor is primarily delivered through phishing or drive-by downloads using deceptive MSI installer files.
These installers silently download the Deno runtime directly from its legitimate project endpoint, requiring no administrative privileges to execute.
Researchers recently analyzed two distinct DinDoor samples, revealing how the malware’s evasion techniques are evolving.
The first sample, named migcredit.pdf.msi, uses a double extension to masquerade as a PDF document from a legitimate Russian financial company.
When executed, it drops a hidden PowerShell script that installs Deno and writes obfuscated JavaScript to the local disk before running it.
In contrast, the second sample, Installer_v1.21.66.msi, demonstrates a more sophisticated, fileless approach.
Packaged with the WiX toolset and signed with a suspicious certificate tied to Russian cybercrime, this variant displays a fake Windows error message to trick the user while silently launching a hidden PowerShell process in the background.
Unmasking the C2 Infrastructure
According to Hunt.io research, the investigation into DinDoor’s network communications revealed a highly organized, shared backend infrastructure.
The fileless installer sample hardcodes a JSON Web Token (JWT) into its C2 URL path. Decoding this token exposes critical campaign metadata, including proxy configurations and the primary C2 domain, serialmenot[.]com.
This domain operates as a multi-tenant infrastructure shared among various state-sponsored and cybercriminal actors. It has previously been linked to the CastleLoader malware family.
By analyzing the HTTP responses from these C2 servers, researchers discovered a consistent pattern.
The active servers returned specific headers indicating the use of a Caddy web server proxy, notably a Via: 1.1 Caddy header and a unique X-Request-Id.
Using a targeted threat-hunting query focused on these HTTP header anomalies and specific 404 error content lengths, investigators successfully mapped the active infrastructure.
This technique unearthed 20 active malicious servers distributed across multiple autonomous systems, including several known bulletproof hosting providers.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
