Iranian Actors Were Inside U.S. Networks Before the Conflict Began. Here's What They Left Behind. 

Two independent research teams, publishing within 24 hours of each other, confirmed the same conclusion: Seedworm (MuddyWater), an Iranian government cyber unit operating under the Ministry of Intelligence and Security, was actively embedded in U.S. and allied networks as geopolitical tensions escalated.

Confirmed targets included a U.S. bank, a U.S. airport, the Israeli operations of a U.S. defense and aerospace software supplier, and multiple NGOs, all hit within the same February 2026 campaign window.

This isn't an elevated risk posture. This is active targeting.

What's Inside the Report:

Forensic analysis of two newly documented malware families, Dindoor and Fakeset, deployed across victim networks in the U.S., Israel, Egypt, Jordan, UAE, and Portugal.

A full breakdown of MuddyWater's three custom C2 frameworks (KeyC2, PersianC2, ArenaC2) recovered directly from a live operator server, including a blockchain-based command channel that standard IP blocklists cannot disrupt.

Active CVEs are being exploited at scale, including vulnerabilities in Fortinet, Ivanti, BeyondTrust, SolarWinds N-Central, and Citrix NetScaler.

Defensive actions organized by threat category, credential attacks, data exfiltration, persistence, and destructive attack preparation, with specific detection guidance and IOCs ready for immediate operationalization.

A full MITRE ATT&CK mapping of observed tactics, techniques, and procedures.

Who Should Read This: Security operations, threat intelligence, and risk teams supporting financial services, transportation, defense contracting, federal agencies, energy, and critical manufacturing.