Loading malware…
Snugy is a PowerShell-based backdoor associated with the xHunt espionage campaign and assessed to be a variant of the CASHY200 backdoor family. It has been used in intrusions targeting organizations in Kuwait, including government, shipping, and transportation environments, and has been observed on compromised Microsoft Exchange infrastructure as part of long-term persistence operations.
Snugy provides remote command execution and basic host identification functionality. Observed behavior includes obtaining the victim system hostname, executing attacker-supplied commands, and exfiltrating command output. Its command-and-control channel uses DNS tunneling, with the malware issuing crafted DNS A-record lookups to actor-controlled infrastructure and interpreting responses to determine whether to transmit host information or execute commands. This covert communications design helps blend malicious traffic into routine name-resolution activity.
In observed xHunt operations, Snugy was deployed as a PowerShell script and persisted through scheduled tasks configured to run at regular intervals with execution-policy bypass. The task names were chosen to resemble legitimate Windows components, indicating deliberate masquerading for defense evasion and persistence. Snugy has been used alongside other xHunt tooling, including the TriFive PowerShell backdoor and the BumbleBee webshell, as part of broader post-compromise activity on Exchange and IIS servers.
Snugy fits xHunt’s pattern of maintaining durable access through lightweight PowerShell implants, covert command channels, and operational blending with legitimate administrative and system behavior. Its role in these intrusions is consistent with espionage-oriented post-exploitation, enabling sustained remote access and collection from compromised Windows servers.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The OfficeIntegrator.ps1 file seen in the ResolutionHosts task is a PowerShell-based backdoor we call Snugy, which allows an actor to obtain the system's hostname and to run commands. Snugy is a variant of the CASHY200 backdoor used by actors in previous attacks in the xHunt campaign.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
On Aug. 28 and Oct. 22, 2019, the actors created the ResolutionHosts and ResolutionsHosts tasks to run two separate PowerShell-based backdoors. The actors used these two scheduled tasks as a persistence method, as they ran the two PowerShell scripts repeatedly, albeit at different intervals.
The suspicious commands being executed via the Internet Information Services (IIS) process w3wp.exe. Actors issued these commands via a web shell we call BumbleBee that had been installed on the Exchange server.
The commands executed by the two tasks attempt to run splwow64.ps1 and OfficeIntegrator.ps1 ... powershell -exec bypass -file C:\Users\Public\Libraries\OfficeIntegrator.ps1 ... powershell -exec bypass -file c:\windows\splwow64.ps1
On Aug. 28 and Oct. 22, 2019, the actors created the ResolutionHosts and ResolutionsHosts tasks to run two separate PowerShell-based backdoors. The actors used these two scheduled tasks as a persistence method, as they ran the two PowerShell scripts repeatedly, albeit at different intervals.
This investigation resulted in the discovery of two new backdoors called TriFive and Snugy... as well as a new webshell that we call BumbleBee... The actor used the BumbleBee webshell to upload and download files to and from the compromised Exchange server, but more importantly, to run commands that the actor used to discover additional systems and to move laterally to other servers on the network.
On Aug. 28 and Oct. 22, 2019, the actors created the ResolutionHosts and ResolutionsHosts tasks to run two separate PowerShell-based backdoors. The actors used these two scheduled tasks as a persistence method, as they ran the two PowerShell scripts repeatedly, albeit at different intervals.
We believe that the actor chose these task names specifically to blend in and appear to be part of the legitimate WDI.
Based on the exfiltrated data from within the subdomains, we were able to determine the actors ran ipconfig /all and dir.
Based on the exfiltrated data from within the subdomains, we were able to determine the actors ran ipconfig /all and dir.
Both of the backdoors installed on the compromised Exchange server of a Kuwait government organization used covert channels for C2 communications, specifically DNS tunneling and an email-based channel using drafts in the Deleted Items folder of a compromised email account.
The Snugy backdoor uses a DNS tunneling channel to run commands on the compromised server.
We did observe the threat actors using the Snugy tool to run commands and exfiltrate the results, as we were able to obtain the domains queried via ping requests sent from the compromised server. Based on the exfiltrated data from within the subdomains, we were able to determine the actors ran ipconfig /all and dir.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.