Loading malware…
BINDCLOAK is a modular, 64-bit Windows backdoor written in C++ and used as a third-stage implant in cyberespionage operations targeting government entities in the Middle East, with a particular focus on the energy sector. It is associated with an unnamed operator assessed to have East Asian ties. Significant code similarities, matching communication structures, and shared command-and-control infrastructure support its identification as a variant of the OctLurk backdoor.
BINDCLOAK is deployed during post-compromise activity through a multistage infection chain involving ISO-based document lures, DLL sideloading, the TELESHIM backdoor, and the MIXEDKEY loader. MIXEDKEY decrypts and reflectively loads BINDCLOAK using environmental keying tied to the victim machine's volume serial number. BINDCLOAK communicates over TLS over TCP, using a custom message-routing protocol with zlib compression and two layers of rolling XOR encoding. Its initial beacon transmits operating-system, computer, user, network, and local-time information.
The backdoor supports dynamically delivered DLL plugins and can initialize, stop, remove, and replace modules. It enumerates running processes, accounts, and access-token properties; obtains user tokens through authentication with supplied credentials; and duplicates and impersonates tokens to execute modules under other security contexts, including higher-privileged accounts when suitable tokens are available. Plugins are reflectively loaded into executable memory. During import resolution, BINDCLOAK schedules library-loading calls through Windows work items to reduce detection of calls originating from unbacked executable memory. These capabilities support extensible post-exploitation, host reconnaissance, privilege escalation through token abuse, and defense evasion.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
This installment provides a detailed technical analysis of BINDCLOAK, a newly discovered modular stage-three backdoor.
The campaign targeted government entities in the Middle East, with a particular focus on the energy sector. Attackers used a multi-stage chain that began with an ISO file and legitimate-looking Windows components before delivering TELESHIM, MIXEDKEY, and finally BINDCLOAK.
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
Similar concerns apply when attackers abuse legitimate processes for malicious DLL payload injection, which can hide code behind trusted Windows activity.
Instead of relying only on a software flaw, BINDCLOAK collects available tokens and uses them to launch its modules with the rights of a more privileged account.
It can attempt to log in with supplied credentials, retain a successful user token, and later use that token to start a selected module.
That allows the operator to select a process token that may offer stronger access, then duplicate it and start a BINDCLOAK module in that security context.
BINDCLOAK can abuse user tokens collected from authenticated with provided credentials
The malware uses heavy code obfuscation, environmental keying, and Telegram API-based command-and-control (C2) communications to evade analysis, blend with legitimate traffic, and maintain persistent access on compromised systems.
Similar concerns apply when attackers abuse legitimate processes for malicious DLL payload injection, which can hide code behind trusted Windows activity.
Instead of relying only on a software flaw, BINDCLOAK collects available tokens and uses them to launch its modules with the rights of a more privileged account.
It can attempt to log in with supplied credentials, retain a successful user token, and later use that token to start a selected module.
That allows the operator to select a process token that may offer stronger access, then duplicate it and start a BINDCLOAK module in that security context.
BINDCLOAK can abuse user tokens collected from authenticated with provided credentials
The threat actor leveraged environmental keying by encrypting BINDCLOAK using a decryption key derived from the infected machine’s volume serial number.
The malware uses heavy code obfuscation, environmental keying, and Telegram API-based command-and-control (C2) communications to evade analysis, blend with legitimate traffic, and maintain persistent access on compromised systems.
Zscaler said in a report that the malware was decrypted and reflectively loaded by MIXEDKEY during post-compromise activity.
ThreatLabz noted that it identified post-compromise activity from the C2 operator, such as system, user, and network reconnaissance commands
ThreatLabz noted that it identified post-compromise activity from the C2 operator, such as system, user, and network reconnaissance commands
The backdoor also examines active processes for their IDs, account details, and token permissions.
The malware collects a wide range of host information for its first beacon, including the operating-system version, computer name, username, hostname, local IP address, and local time.
The malware uses heavy code obfuscation, environmental keying, and Telegram API-based command-and-control (C2) communications to evade analysis, blend with legitimate traffic, and maintain persistent access on compromised systems.
This installment provides a detailed technical analysis of BINDCLOAK, a newly discovered modular stage-three backdoor... ThreatLabz assesses with high confidence that BINDCLOAK is a variant of OctLurk and examines its previously undocumented C2 communication channel.
BINDCLOAK communicates with its command server through TLS over TCP, using a custom message-routing system.
BINDCLOAK uses TLS over TCP for C2 communication
The malware can also stop, remove, and replace modules, helping operators adjust their tools without reinstalling the full backdoor.
BINDCLOAK uses two layers of XOR encoding for C2 communication
the final payload is locked behind two layers of XOR encryption, the second layer using a technique called environmental keying by encrypting it by means of a decryption key derived from the infected machine's volume serial number
35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.