Loading malware…
A0Backdoor is a newly identified, memory-resident backdoor observed in campaigns active from at least August 2025 through late February 2026. It has been linked by reporting to the Blitz Brigantine activity cluster, also tracked as Storm-1811 and STAC5777, with overlaps to Black Basta-associated social-engineering tradecraft and some reporting also noting Cactus affiliate associations. Victimology in the reporting includes finance and healthcare organizations, including a Canada-based financial institution and a global health-aligned organization.
The infection chain described in the reporting relies on social engineering rather than direct exploitation. Attackers first conduct email bombing, then impersonate internal IT support over Microsoft Teams and persuade targets to launch Windows Quick Assist, granting remote access. After access is obtained, operators deploy digitally signed MSI installers masquerading as Microsoft software, including Microsoft Teams-related components and CrossDeviceService/"Cross Device Add-in." These installers drop legitimate Microsoft binaries together with attacker-controlled DLLs and use DLL sideloading, most notably via a malicious hostfxr.dll, to launch the malware. Reporting also mentions additional sideloading components such as domain_actions.dll, spoofed zlib1.dll, spoofed sqlite3.dll, and in some samples clipsp.dll.
The loader chain uses multiple anti-analysis and evasion techniques before launching A0Backdoor. Reported behaviors include junk functions, excessive CreateThread calls intended to hinder debugging, runtime decryption of embedded data from the DLL, environmental keying based on system time with an execution window of roughly 55 hours, and command-line key material that incorporates a trailing non-breaking space character (U+00A0). The shellcode also checks firmware tables for sandbox or virtualization indicators such as QEMU and can alter or prevent successful decryption in analysis environments. After decryption, execution is redirected to the A0Backdoor entry point.
Once active, A0Backdoor copies itself into a new memory region and decrypts core routines in memory. It fingerprints infected hosts using Windows APIs including DeviceIoControl, GetUserNameExW, and GetComputerNameW to collect system and user information. Its command-and-control channel uses covert DNS tunneling rather than direct outbound connections to attacker infrastructure. Reporting states that it issues DNS MX queries through trusted public recursive resolvers such as 1.1.1.1 and 8.8.8.8, encodes beacon metadata in high-entropy subdomains, and decodes command data from the leftmost label of MX exchange hostnames returned by attacker-controlled authoritative servers. This design is intended to blend with normal DNS traffic and evade detections focused on TXT-record tunneling or direct C2 traffic.
High-confidence indicators mentioned in the reporting include the domain fsdgh[.]com, malicious MSI filenames such as Update.msi and UpdateFX.msi, installation paths under %LocalAppData%\Microsoft\CrossDevice Share\25017.203.3370\ and %LocalAppData%\Microsoft\TeamsPhoneAddins\3.1.1.15, and use of code-signing certificates including one issued to MULTIMEDIOS CORDILLERANOS SRL. Multiple reports state that samples were digitally signed, including with a now-revoked Extended Validation certificate associated with that Argentinian media company.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BlueVoyant researchers observed the threat group’s software was digitally signed MSI Packages... the actors sideload a malicious DLL to deliver a new backdoor BlueVoyant has dubbed the A0Backdoor.
BlueVoyant researchers observed the threat group’s software was digitally signed MSI Packages... the actors sideload a malicious DLL to deliver a new backdoor BlueVoyant has dubbed the A0Backdoor.
BlueVoyant researchers observed the threat group’s software was digitally signed MSI Packages... the actors sideload a malicious DLL to deliver a new backdoor BlueVoyant has dubbed the A0Backdoor.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Researchers found at least some of these MSI packages were hosted on Microsoft cloud storage tied to personal accounts ... and delivered via tokenized download links.
The malicious code only decrypts itself if it executes within a specific 55-hour time window after delivery... the malware requires a specific invisible Unicode space character appended to a command-line argument to generate the correct decryption key.
Initial analysis of hostfxr.dll indicated it contained compressed or encrypted data within its .data section.
After decrypting the payload, the shellcode locates the export named ‘ set_error_writer ’ and overwrites the associated function code with a jump that redirects execution to the entry point of the newly decrypted A0 Backdoor.
the tenants they registered for the operation carried display names so generic that they passed unnoticed: ‘Help Desk’, ‘Help Desk IT’, ‘Help Desk Support’, ‘IT Support’.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Masquerading: Match Legitimate Name T1036.005 "Microsoft Cross Device Add-in" branding
Like many malware loaders, the primary purpose of hostfxr.dll was to decrypt the data stored in its .data section into a newly allocated memory region, mark that memory as writable and executable, and then transfer execution to it.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution System Services: Windows Installer T1218.007 MSI CustomAction type 1234 (SYSTEM context)
When execution occurs outside the intended time window, the computed time-slot changes and the subsequent keying material differs, which prevents decryption of the embedded payload.
First, the shellcode queries the firmware table of the virtual machine using the API ‘ GetSystemFirmwareTable ’. Once obtained, the shellcode searches the results for the string ‘ QEMU ’.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Virtualization/Sandbox Evasion T1497.001 QEMU detection, 55-hour time window
The backdoor immediately gathers details about the computer, including the username and system device information, so the hackers can easily identify their new victim.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery Process Discovery T1057 Process enumeration
Once decrypted, the backdoor proceeds to fingerprint the compromised system by collecting host-specific information. This is accomplished through Windows API calls such as ‘ DeviceIoControl ’, ‘ GetUserNameExW ’, and ‘ GetComputerNameW ’.
First, the shellcode queries the firmware table of the virtual machine using the API ‘ GetSystemFirmwareTable ’. Once obtained, the shellcode searches the results for the string ‘ QEMU ’.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Virtualization/Sandbox Evasion T1497.001 QEMU detection, 55-hour time window
The A0Backdoor establishes communication with its C2 infrastructure using a technique known as DNS tunnelling, specifically via a covert DNS channel.
Delivery is consistently via MSIs masquerading as Microsoft/Teams packages (Update.msi/UpdateFX.msi, Microsoft Teams Phone Link, Cross Device Add-in).
Data is encoded and hidden inside MX record queries — normally used for email routing
The authoritative server replies with an MX record that has a valid preference and an “exchange” hostname whose leftmost label encodes response data using a domain-safe alphanumeric alphabet.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor malware referenced as part of a separate but similar Microsoft Teams social-engineering campaign in which victims were induced to start Quick Assist sessions.
A previously undocumented backdoor payload delivered in a campaign linked to Storm-1811/BlackBasta tradecraft. It is decrypted in memory after a malicious hostfxr.dll sideloads into a legitimate process, and its command-and-control traffic hides in DNS MX queries.
A0Backdoor is described as a newly observed backdoor/loader delivered via DLL sideloading after attackers gained remote access through Quick Assist. It uses a 55-hour time-based decryption window, requires a hidden Unicode space character in a command-line argument for correct decryption, checks for QEMU/VirtualBox/VMware artifacts to evade sandboxes, spawns junk threads to disrupt debuggers, and communicates with command-and-control infrastructure through DNS tunneling using MX record queries via public resolvers.
Related Articles: Microsoft Teams phishing targets employees with A0Backdoor malware
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.