<?xml version="1.0" encoding="UTF-8"?><rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom" version="2.0"><channel><title><![CDATA[Iran-linked MuddyWater APT reportedly breached organizations across 9 countries in Q1 2026 using DLL sideloading, PowerShell implants, Chromium credential theft, and SOCKS5 tunneling]]></title><description><![CDATA[<p>Iran-linked MuddyWater APT reportedly breached organizations across 9 countries in Q1 2026 using DLL sideloading, PowerShell implants, Chromium credential theft, and SOCKS5 tunneling.<br />Researchers say signed Fortemedia &amp; SentinelOne binaries were abused for stealth.</p><p></p><div class="card col-md-9 col-lg-6 position-relative link-preview p-0">



<a href="https://www.technadu.com/iran-linked-muddywater-group-breached-organizations-in-9-countries-in-q1-2026-including-major-electronics-maker/627875/" title="Iran-Linked MuddyWater Group Breached Organizations in 9 Countries in Q1 2026, Including Major Electronics Maker">
<img src="https://cdn.technadu.com/wp-content/uploads/2026/05/Electronics-Factory-Robotic-Assembly-Line-Signed-Software-Icons.jpg" class="card-img-top not-responsive" style="max-height:15rem" alt="Link Preview Image" />
</a>





<div class="card-body">
<h5 class="card-title">
<a href="https://www.technadu.com/iran-linked-muddywater-group-breached-organizations-in-9-countries-in-q1-2026-including-major-electronics-maker/627875/">
Iran-Linked MuddyWater Group Breached Organizations in 9 Countries in Q1 2026, Including Major Electronics Maker
</a>
</h5>
<p class="card-text line-clamp-3">Iran-linked MuddyWater abused signed binaries to breach global targets, including a major Korean electronics firm.</p>
</div>
<a href="https://www.technadu.com/iran-linked-muddywater-group-breached-organizations-in-9-countries-in-q1-2026-including-major-electronics-maker/627875/" class="card-footer text-body-secondary small d-flex gap-2 align-items-center lh-2">



<img src="https://cdn.technadu.com/wp-content/uploads/2018/03/cropped-TechNadu-Logo_TechNadu-V-1-Black-copy-1-32x32.png" alt="favicon" class="not-responsive overflow-hiddden" style="max-width:21px;max-height:21px" />







<p class="d-inline-block text-truncate mb-0">TechNadu <span class="text-secondary">(www.technadu.com)</span></p>
</a>
</div><p></p><p><a href="https://infosec.exchange/tags/CyberSecurity" rel="tag">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/ThreatIntel" rel="tag">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/APT" rel="tag">#<span>APT</span></a> <a href="https://infosec.exchange/tags/InfoSec" rel="tag">#<span>InfoSec</span></a></p>

<div class="row mt-3"><div class="col-12 mt-3"><img class="img-thumbnail" src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/573/090/057/169/659/original/e7dc9a69cc9e9b99.png" alt="Link Preview Image" /></div></div>]]></description><link>https://board.circlewithadot.net/topic/5fafa023-8d60-45e3-8266-feebfce3c857/iran-linked-muddywater-apt-reportedly-breached-organizations-across-9-countries-in-q1-2026-using-dll-sideloading-powershell-implants-chromium-credential-theft-and-socks5-tunneling</link><generator>RSS for Node</generator><lastBuildDate>Thu, 14 May 2026 22:32:32 GMT</lastBuildDate><atom:link href="https://board.circlewithadot.net/topic/5fafa023-8d60-45e3-8266-feebfce3c857.rss" rel="self" type="application/rss+xml"/><pubDate>Thu, 14 May 2026 13:11:06 GMT</pubDate><ttl>60</ttl></channel></rss>