MuddyWater Deno Runtime Abuse (eval)

Ibrahim Saud@tektrix

•updated Jun 17, 2026•1•0•8

Detects deno.exe executing inline scripts via 'eval', indicating DINODANCE/Tsundere malware execution. This behavior is associated with the MuddyWater APT group.