Seedworm APT Hijacks Signed Fortemedia and SentinelOne Binaries for Stealthy DLL Sideloading
Iran‑linked Seedworm (MuddyWater) ran an espionage campaign in early 2026 against nine organizations across nine countries, abusing legitimate Fortemedia fmapp.exe and SentinelOne sentinelmemoryservice.exe binaries to sideload malicious DLLs. The loaders delivered ChromElevator, stealing browser credentials and data, while a Node.js script orchestrated the attack.