MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries
2026-05-27T07:24:15Z•8ccf10b51bc81c23a8b12955cb99e7439fe7fcc454091b16b922f1e308205fa4
Crates.ioPyPIai-assisted-attackscert-in-12hr-patchingcisa-kevcobalt-strikecredential-stealerdll-side-loadingespionagegodzilla-webshelllaravel-langlazarusmegalodonmfa-prompt-bombingmuddywaternpmpackagistremotepesupply-chain-attack
What happened
The feed summarizes a surge of high-impact cyber activity in Q1–Q2 2026: an Iranian APT (MuddyWater) used DLL side-loading in a multinational espionage campaign; multiple high/critical vulnerabilities were disclosed and actively exploited (including SharePoint, Ghost CMS, LiteSpeed cPanel, Cisco Secure Workload, KnowledgeDeliver and Drupal), and several flaws were added to CISA's KEV. There is broad supply-chain abuse (TrapDoor across npm/PyPI/Crates.io, Packagist, Laravel-Lang), mass malicious CI/CD commits (Megalodon), state-linked malware campaigns (Lazarus/RemotePE, Nimbus Manticore), and攻
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 8ccf10b51bc81c23a8b12955cb99e7439fe7fcc454091b16b922f1e308205fa4
- Enrichment time
- 2026-05-27T07:24:15Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.