MEDIUMApt
Global

MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries

·Source: The Hacker News

Updated:

Executive Summary

The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. The activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.

Analysis

The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. The activity targeted industrial and electronics manufacturing, education and public-sector bodies, financial services, and professional services, per the Threat Hunter Team from Symantec and Carbon Black.
Source Attribution

Originally published by The Hacker News on May 26, 2026.

Related Threats

MEDIUMApt

LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine

ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked espionage groups.

SentinelLabs
MEDIUMVulnerability

Klarna adds healthcare to membership programme

Kry Livi, the UK's leading digital healthcare provider, today announces a new partnership with Klarna, the global digital bank and flexible payments provider, bringing on-demand clinical consultations to Klarna's UK members as digital-first healthcare continues to grow.

Finextra
CRITICALMalware

Attackers exploit Palo Alto GlobalProtect flaw days after disclosure

A Palo Alto Networks vulnerability that allows attackers to establish unauthorized VPN access into corporate networks is being actively exploited in the wild, weeks after the company disclosed the flaw as a medium-severity issue and said it was unaware of any attacks. However, according to Rapid7, threat actors began exploiting the bug within days of disclosure. “Rapid7 MDR identified successful e

CVE-2026-0257
CSO Online