Loading malware…
A0Backdoor is a newly identified, memory-resident backdoor observed in campaigns active from at least August 2025 through late February 2026. It has been linked by reporting to the Blitz Brigantine activity cluster, also tracked as Storm-1811 and STAC5777, with overlaps to Black Basta-associated social-engineering tradecraft and some reporting also noting Cactus affiliate associations. Victimology in the reporting includes finance and healthcare organizations, including a Canada-based financial institution and a global health-aligned organization.
The infection chain described in the reporting relies on social engineering rather than direct exploitation. Attackers first conduct email bombing, then impersonate internal IT support over Microsoft Teams and persuade targets to launch Windows Quick Assist, granting remote access. After access is obtained, operators deploy digitally signed MSI installers masquerading as Microsoft software, including Microsoft Teams-related components and CrossDeviceService/"Cross Device Add-in." These installers drop legitimate Microsoft binaries together with attacker-controlled DLLs and use DLL sideloading, most notably via a malicious hostfxr.dll, to launch the malware. Reporting also mentions additional sideloading components such as domain_actions.dll, spoofed zlib1.dll, spoofed sqlite3.dll, and in some samples clipsp.dll.
The loader chain uses multiple anti-analysis and evasion techniques before launching A0Backdoor. Reported behaviors include junk functions, excessive CreateThread calls intended to hinder debugging, runtime decryption of embedded data from the DLL, environmental keying based on system time with an execution window of roughly 55 hours, and command-line key material that incorporates a trailing non-breaking space character (U+00A0). The shellcode also checks firmware tables for sandbox or virtualization indicators such as QEMU and can alter or prevent successful decryption in analysis environments. After decryption, execution is redirected to the A0Backdoor entry point.
Once active, A0Backdoor copies itself into a new memory region and decrypts core routines in memory. It fingerprints infected hosts using Windows APIs including DeviceIoControl, GetUserNameExW, and GetComputerNameW to collect system and user information. Its command-and-control channel uses covert DNS tunneling rather than direct outbound connections to attacker infrastructure. Reporting states that it issues DNS MX queries through trusted public recursive resolvers such as 1.1.1.1 and 8.8.8.8, encodes beacon metadata in high-entropy subdomains, and decodes command data from the leftmost label of MX exchange hostnames returned by attacker-controlled authoritative servers. This design is intended to blend with normal DNS traffic and evade detections focused on TXT-record tunneling or direct C2 traffic.
High-confidence indicators mentioned in the reporting include the domain fsdgh[.]com, malicious MSI filenames such as Update.msi and UpdateFX.msi, installation paths under %LocalAppData%\Microsoft\CrossDevice Share\25017.203.3370\ and %LocalAppData%\Microsoft\TeamsPhoneAddins\3.1.1.15, and use of code-signing certificates including one issued to MULTIMEDIOS CORDILLERANOS SRL. Multiple reports state that samples were digitally signed, including with a now-revoked Extended Validation certificate associated with that Argentinian media company.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
BlueVoyant researchers observed the threat group’s software was digitally signed MSI Packages... the actors sideload a malicious DLL to deliver a new backdoor BlueVoyant has dubbed the A0Backdoor.
BlueVoyant researchers observed the threat group’s software was digitally signed MSI Packages... the actors sideload a malicious DLL to deliver a new backdoor BlueVoyant has dubbed the A0Backdoor.
BlueVoyant researchers observed the threat group’s software was digitally signed MSI Packages... the actors sideload a malicious DLL to deliver a new backdoor BlueVoyant has dubbed the A0Backdoor.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
On 4 November last year, an external user signed into a customer environment under the display name “IT Support”... Within twenty-eight minutes they had opened a Quick Assist screen-share session against a target who believed he was speaking to colleagues.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Initial Access Phishing: Spearphishing via Service T1566.003 Microsoft Teams social engineering
Researchers found at least some of these MSI packages were hosted on Microsoft cloud storage tied to personal accounts ... and delivered via tokenized download links.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious File T1204.002 Update.msi execution via Quick Assist
the malicious hostfxr.dll sideloads itself into a legitimate process and decrypts A0Backdoor only once it is resident in memory
“…A0Backdoor, a memory-resident backdoor…”
The malicious code only decrypts itself if it executes within a specific 55-hour time window after delivery... the malware requires a specific invisible Unicode space character appended to a command-line argument to generate the correct decryption key.
Initial analysis of hostfxr.dll indicated it contained compressed or encrypted data within its .data section.
After decrypting the payload, the shellcode locates the export named ‘ set_error_writer ’ and overwrites the associated function code with a jump that redirects execution to the entry point of the newly decrypted A0 Backdoor.
the tenants they registered for the operation carried display names so generic that they passed unnoticed: ‘Help Desk’, ‘Help Desk IT’, ‘Help Desk Support’, ‘IT Support’.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Masquerading: Match Legitimate Name T1036.005 "Microsoft Cross Device Add-in" branding
“…A0Backdoor, a memory-resident backdoor…”
Like many malware loaders, the primary purpose of hostfxr.dll was to decrypt the data stored in its .data section into a newly allocated memory region, mark that memory as writable and executable, and then transfer execution to it.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution System Services: Windows Installer T1218.007 MSI CustomAction type 1234 (SYSTEM context)
When execution occurs outside the intended time window, the computed time-slot changes and the subsequent keying material differs, which prevents decryption of the embedded payload.
First, the shellcode queries the firmware table of the virtual machine using the API ‘ GetSystemFirmwareTable ’. Once obtained, the shellcode searches the results for the string ‘ QEMU ’.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Virtualization/Sandbox Evasion T1497.001 QEMU detection, 55-hour time window
“incorporates a time-based execution mechanism… divides it into execution windows lasting roughly 55 hours… outside the expected time slot… preventing… malware from executing successfully.”
the malicious hostfxr.dll sideloads itself into a legitimate process and decrypts A0Backdoor only once it is resident in memory
At runtime, hostfxr.dll makes extensive use of ‘ CreateThread ’ calls. This behavior is intended to hinder dynamic analysis.
In late May 2024, Microsoft watched a financially motivated cybercriminal group it tracks as Storm-1811 do something that traditional perimeter controls were not built to see- it logged into Teams, said hello, and asked for help.
To make the files look completely safe, the hackers host them on personal Microsoft cloud storage accounts and sign them with digital certificates.
The backdoor immediately gathers details about the computer, including the username and system device information, so the hackers can easily identify their new victim.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery Process Discovery T1057 Process enumeration
Once decrypted, the backdoor proceeds to fingerprint the compromised system by collecting host-specific information. This is accomplished through Windows API calls such as ‘ DeviceIoControl ’, ‘ GetUserNameExW ’, and ‘ GetComputerNameW ’.
First, the shellcode queries the firmware table of the virtual machine using the API ‘ GetSystemFirmwareTable ’. Once obtained, the shellcode searches the results for the string ‘ QEMU ’.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Virtualization/Sandbox Evasion T1497.001 QEMU detection, 55-hour time window
“incorporates a time-based execution mechanism… divides it into execution windows lasting roughly 55 hours… outside the expected time slot… preventing… malware from executing successfully.”
MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery System Language Discovery T1614.001 Locale checks
At runtime, hostfxr.dll makes extensive use of ‘ CreateThread ’ calls. This behavior is intended to hinder dynamic analysis.
The cloud and software giant’s threat intelligence team had already documented the same operators abusing the Quick Assist remote support tool since mid-April that year... Within twenty-eight minutes they had opened a Quick Assist screen-share session against a target
"Approving a Quick Assist remote session would then allow the distribution of malicious MSI files..."
“After convincing victims to grant access — often through remote support tools such as Quick Assist — the attackers deploy malicious MSI installer packages…”
The A0Backdoor establishes communication with its C2 infrastructure using a technique known as DNS tunnelling, specifically via a covert DNS channel.
Delivery is consistently via MSIs masquerading as Microsoft/Teams packages (Update.msi/UpdateFX.msi, Microsoft Teams Phone Link, Cross Device Add-in).
Data is encoded and hidden inside MX record queries — normally used for email routing
The authoritative server replies with an MX record that has a valid preference and an “exchange” hostname whose leftmost label encodes response data using a domain-safe alphanumeric alphabet.
The victim, believing they are talking to company support, grants remote access through Quick Assist, a built-in Windows tool that lets one computer be controlled by another.
The hackers also intentionally use older, previously registered website names rather than creating brand-new ones. This strategy helps them bypass automated security filters that usually block newly registered domains.
Rather than opening direct sessions to attacker-controlled infrastructure, the backdoor issues DNS queries to a public resolver ... while still exchanging commands over DNS.
16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.