Loading story…
Sophos X-Ops reported that attackers used covert communication channels in a backdoor deployed against network-connected devices, allowing malicious traffic to blend into normal activity and making the intrusion harder to detect. The operation involved a backdoor designed to maintain access on compromised devices while concealing command-and-control exchanges from defenders monitoring conventional indicators.
The finding highlights a stealth technique that can complicate incident response on edge infrastructure and other embedded systems, where visibility is often limited. By hiding communications inside seemingly legitimate traffic patterns, the attackers increased the likelihood of long-term persistence and reduced the chance that standard network monitoring would immediately identify the compromise.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A new report described BPFDoor variants that hide communications through stateless command-and-control methods and ICMP relay techniques. The disclosure added technical detail on how the malware operates and evades detection.
Sophos X-Ops published research describing attackers using covert channels in a backdoor targeting devices. No additional incident dates or intermediate developments are provided in the reference metadata.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos X-Ops reported a limited series of attacks against Sophos Firewall devices in which attackers exploited **`CVE-2022-3236`** and deployed a sophisticated mix of custom and commodity Linux malware. The intrusions included modifications to legitimate SFOS Java and Perl components, most notably a trojanized **`servlet-api-3.1.jar`** that captured administrator credentials, encrypted them, and accepted hidden commands through the **`JSESSIONID`** cookie field, creating a covert backdoor on compromised devices. Investigators identified at least eight malicious file types, including a custom Metasploit JAR, multiple Linux backdoors, a **Termite**-labeled RAT, and **Gh0st RAT** variants that used crafted **ICMP** packets for traffic signaling. The malware enabled file manipulation, shell execution, persistence, encrypted command-and-control, SOCKS proxying, and stealthy communications, indicating a highly capable threat actor focused on maintaining control of firewall appliances while minimizing detection.
Jun 29, 2026
Kaspersky reported an intrusion at a large enterprise in which attackers repurposed the open-source hypervisor **QEMU** as a stealthy tunneling tool to move traffic across segmented systems. The operators launched a minimal virtual machine with about **1 MB of RAM**, no disk image, and no graphical interface, then used QEMU to create virtual network interfaces and a socket-based network device that forwarded traffic from an internal host to attacker-controlled infrastructure. The tunnel linked a victim system without direct internet access to a pivot host that could reach the internet, and then on to a cloud server hosting a Kali Linux virtual machine. The activity stood out because defenders more commonly watch for tunneling utilities such as **FRP**, **ngrok**, and **Cloudflare Tunnel**, while QEMU can blend into legitimate virtualization activity and attract less scrutiny. In the same compromise, the attackers also used **Angry IP Scanner** for internal reconnaissance and **mimikatz** for credential theft, showing how legitimate administration and offensive tools were combined for lateral movement and persistence. The reporting highlights the need for layered detection across endpoints and networks, including monitoring for unusual QEMU execution, unexpected virtual interfaces, and traffic paths that bridge isolated network segments.
Jul 12, 2026
Researchers disclosed **SockDetour**, a previously undocumented Windows backdoor used against U.S. defense contractors as a stealthy secondary implant for persistence. The malware operates **filelessly** and **socketlessly**, hijacking legitimate processes' network sockets with the Microsoft Detours library to create an encrypted command-and-control channel that is difficult to spot through host or network monitoring. Palo Alto Networks Unit 42 said at least four U.S.-based defense contractors were targeted and confirmed compromise at one organization, with compilation artifacts indicating the tool may have been in use since at least **July 2019**. Unit 42 linked the activity to the China-linked **TiltedTemple** cluster, also tracked by Microsoft as **DEV-0322**, and said the campaign overlapped with late-2021 intrusions involving **Zoho ManageEngine** exploitation; reporting also noted possible ties to **APT27** based on tactics and targeting. In one case, attackers delivered SockDetour from an external FTP server hosted on a compromised **QNAP NAS** device that had likely been exploited through **`CVE-2021-28799`**, the same flaw previously abused to deploy **eCh0raix** and associated with earlier **QLocker** ransomware activity, showing how vulnerable internet-facing NAS infrastructure was repurposed to support espionage operations.
Aug 15, 2026