StingyBasilisk APT Uses Windows Named Pipes and COM Hijacking for Espionage and Stealthy Network Control
The previously unidentified espionage group StingyBasilisk has operated covertly since at least April 2022, employing sophisticated tactics including COM hijacking and abuse of Windows Time Providers for persistence. Starting February 2026, they propagated laterally across networks via SMB, deploying payloads in Windows Temp folders and executing them through customized scheduled tasks via Impacket's atexec. The group controls malware implants using Windows named pipes with encrypted communication leveraging Curve25519 ECDH and modified ChaCha20 encryption, evading detection by masquerading as legitimate security tools. Their loader CunningDoor uses DLL sideloading with signed SafeNet libraries and employs anti-API monitoring techniques through direct system calls. The attack demonstrates notable stealth and innovative network command and control mechanisms with no fixed C2 addresses, posing a high operational threat requiring monitoring of TreatAs registry changes, W32Time provider entries, suspicious SMB named pipe traffic, and rundll32 processes loading vendor DLLs from Temp folders.
Linha do tempo
-
StingyBasilisk APT Uses Windows Named Pipes and COM Hijacking for Espionage and Stealthy Network Control
ler a análise desta fonte ocultar
The previously unidentified espionage group StingyBasilisk has operated covertly since at least April 2022, employing sophisticated tactics including COM hijacking and abuse of Windows Time Providers for persistence. Starting February 2026, they propagated laterally across networks via SMB, deploying payloads in Windows Temp folders and executing them through customized scheduled tasks via Impacket's atexec. The group controls malware implants using Windows named pipes with encrypted communication leveraging Curve25519 ECDH and modified ChaCha20 encryption, evading detection by masquerading as legitimate security tools. Their loader CunningDoor uses DLL sideloading with signed SafeNet libraries and employs anti-API monitoring techniques through direct system calls. The attack demonstrates notable stealth and innovative network command and control mechanisms with no fixed C2 addresses, posing a high operational threat requiring monitoring of TreatAs registry changes, W32Time provider entries, suspicious SMB named pipe traffic, and rundll32 processes loading vendor DLLs from Temp folders.