Loading malware…
Naid is a Windows malware family associated with persistence through Windows service creation and Registry modification, and with basic host reconnaissance. It creates a new service and corresponding Registry entries that reference a malicious DLL dropped to disk, indicating service-based persistence and execution. Naid also collects the compromised host’s domain name, reflecting local environment discovery useful for victim profiling and follow-on intrusion activity. The documented behavior supports classification as a Windows backdoor or service-based implant focused on maintaining access and gathering host context.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
Catchamas creates three Registry keys to establish persistence by adding a Windows Service ... TEARDROP modified the Registry to create a Windows service for itself ... NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
Catchamas creates three Registry keys to establish persistence by adding a Windows Service ... TEARDROP modified the Registry to create a Windows service for itself ... NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Collects domain names from compromised hosts.
Backdoor that collects the domain name from compromised hosts.
Trojan that creates service-related Registry entries pointing to a malicious DLL.
Malware that creates a new Windows service for persistence.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.