Malware

PortDoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Its main capabilities include: Gathering reconnaissance and profiling of the victim’s machine

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The initial infection vector is a spear-phishing email addressed to the “respectful general director Igor Vladimirovich” at the Rubin Design Bureau... The email attachment is a malicious RTF document weaponized with a RoyalRoad payload

Execution

1 technique

T1059.003Windows Command ShellEvidence1

MITRE ATT&CK Matrix ... Command and Scripting Interpreter: Windows Command Shell

Persistence

1 technique

T1137.006Add-insEvidence1

Once the RTF document is opened and executed, a Microsoft Word add-in file is dropped to the Microsoft Word startup folder. This technique is used by various actors to bypass detection of automatic execution persistence

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

MITRE ATT&CK Matrix ... Process Injection

T1134.001Token Impersonation/TheftEvidence1

PortDoor also has the ability to achieve privilege escalation by applying the Access Token Theft technique to steal explorer.exe tokens and run under a privileged security context

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence1

One byte XOR encryption of sensitive data and configuration strings

T1027.007Dynamic API ResolutionEvidence1

Another anti-analysis technique observed being used by the PortDoor backdoor is dynamic API resolving. The backdoor is able to hide most of its main functionality and avoid static detection of suspicious API calls by dynamically resolving its API calls instead of using static imports

T1036.005Match Legitimate Resource Name or LocationEvidence1

this new RoyalRoad variant uses “e.o” naming convention for the temporary file payload, which is eventually written to MS Word startup folder as “winlog.wll”

T1055Process InjectionEvidence1

MITRE ATT&CK Matrix ... Process Injection

T1134.001Token Impersonation/TheftEvidence1

PortDoor also has the ability to achieve privilege escalation by applying the Access Token Theft technique to steal explorer.exe tokens and run under a privileged security context

T1218.011Rundll32Evidence1

MITRE ATT&CK Matrix ... Signed Binary Proxy Execution: Rundll32

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Matrix ... Virtualization/Sandbox Evasion

Discovery

5 techniques

T1057Process DiscoveryEvidence1

Case Action 0x30 List running processes

T1082System Information DiscoveryEvidence1

For example, the get_pc_info() case gathers basic PC info to be sent to the C2

T1083File and Directory DiscoveryEvidence1

Case Action 0x42 Files enumeration

T1124System Time DiscoveryEvidence1

MITRE ATT&CK Matrix ... System Time Discovery

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Matrix ... Virtualization/Sandbox Evasion

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

the malware then proceeds to attempt to establish a connection with the C2 which supports the transfer of data using TCP over raw sockets, or HTTPS using the CONNECT method

T1090.002External ProxyEvidence1

the backdoor appears to be proxy-aware, distinguishing between two HTTP response types: “200” response and “407” (Proxy Authentication Required)

T1573Encrypted ChannelEvidence1

The collected information is AES-encrypted before it is sent to the C2 server

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cybereason blogNews

Jan 1, 2025

PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector

A previously undocumented stealthy backdoor dropped by a RoyalRoad-weaponized RTF. It performs reconnaissance and victim profiling, communicates with C2 over raw sockets or HTTP/HTTPS with proxy support, downloads additional payloads, steals explorer.exe tokens for privilege escalation, manipulates processes, dynamically resolves APIs for evasion, uses one-byte XOR to decrypt strings/configuration, and AES-encrypts exfiltrated host data.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

PortDoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Its main capabilities include: Gathering reconnaissance and profiling of the victim’s machine

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Execution

1 technique

T1059.003Windows Command ShellEvidence1

MITRE ATT&CK Matrix ... Command and Scripting Interpreter: Windows Command Shell

Persistence

1 technique

T1137.006Add-insEvidence1

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

MITRE ATT&CK Matrix ... Process Injection

T1134.001Token Impersonation/TheftEvidence1

PortDoor also has the ability to achieve privilege escalation by applying the Access Token Theft technique to steal explorer.exe tokens and run under a privileged security context

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence1

One byte XOR encryption of sensitive data and configuration strings

T1027.007Dynamic API ResolutionEvidence1

T1036.005Match Legitimate Resource Name or LocationEvidence1

this new RoyalRoad variant uses “e.o” naming convention for the temporary file payload, which is eventually written to MS Word startup folder as “winlog.wll”

T1055Process InjectionEvidence1

MITRE ATT&CK Matrix ... Process Injection

T1134.001Token Impersonation/TheftEvidence1

PortDoor also has the ability to achieve privilege escalation by applying the Access Token Theft technique to steal explorer.exe tokens and run under a privileged security context

T1218.011Rundll32Evidence1

MITRE ATT&CK Matrix ... Signed Binary Proxy Execution: Rundll32

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Matrix ... Virtualization/Sandbox Evasion

Discovery

5 techniques

T1057Process DiscoveryEvidence1

Case Action 0x30 List running processes

T1082System Information DiscoveryEvidence1

For example, the get_pc_info() case gathers basic PC info to be sent to the C2

T1083File and Directory DiscoveryEvidence1

Case Action 0x42 Files enumeration

T1124System Time DiscoveryEvidence1

MITRE ATT&CK Matrix ... System Time Discovery

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Matrix ... Virtualization/Sandbox Evasion

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

the malware then proceeds to attempt to establish a connection with the C2 which supports the transfer of data using TCP over raw sockets, or HTTPS using the CONNECT method

T1090.002External ProxyEvidence1

the backdoor appears to be proxy-aware, distinguishing between two HTTP response types: “200” response and “407” (Proxy Authentication Required)

T1573Encrypted ChannelEvidence1

The collected information is AES-encrypted before it is sent to the C2 server

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

cybereason blogNews

Jan 1, 2025

PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.