In February 2026, the Iranian cyber espionage group MuddyWater, also known as Mango Sandstorm, executed a targeted intrusion campaign against select organizations in the U.S., Israel, and Canada. The campaign, revealed in March 2026, employed two primary malware tools: Dindoor, a backdoor utilizing the Deno runtime, and Fakeset, a Python-based implant. This operation was marked by the use of legitimate tools and cloud services to ensure persistent access and facilitate data exfiltration, aligning closely with Iranian state interests, notably the Ministry of Intelligence and Security (MOIS).