Loading story…
Sophos researchers reported on a signed backdoor that blended malicious activity with deceptive on-screen behavior, using trusted code-signing to reduce suspicion and improve execution on victim systems. The malware stood out for pairing backdoor functionality with techniques designed to manipulate what users or defenders might see, suggesting an effort to hide its true behavior behind misleading visual cues while maintaining persistent remote access.
The report highlights how valid or apparently trusted signatures can be abused to make malware appear legitimate, complicating detection and response. The case underscores the risk of relying too heavily on code-signing reputation alone and shows how attackers continue combining defense evasion, stealthy persistence, and user-facing deception to keep backdoors active inside compromised environments.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos released a threat research article describing a strange signed backdoor in a post titled 'Smoke and (screen) mirrors: A strange signed backdoor.' No additional incident chronology or victim-specific events are provided in the reference content.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos X-Ops reported a malicious Windows backdoor that was discovered after a false-positive review of an executable signed with a valid **Microsoft Windows Hardware Compatibility Publisher** certificate. The malware appeared to impersonate **Thales**, installed itself as a service named `CatalogWatcher`, embedded the **3proxy** proxy server, and used an XOR-obfuscated command-and-control domain, `catalog[.]micrisoftdrivers[.]com`. Sophos said the abuse was serious because the trusted signature could help the malware evade scrutiny and blend into enterprise environments. Telemetry and VirusTotal data linked the backdoor to the **LaiXi Android Screen Mirroring** product, with related samples dating back to at least January 2023 across four compilation clusters that included signed and unsigned variants. Sophos said it found no evidence that LaiXi’s developers intentionally shipped the malware or that a broader supply-chain compromise had occurred, but urged caution because the association persisted over time. Microsoft was notified through the Microsoft Security Response Center and later added the affected files to its revocation list under **`CVE-2024-26234`**.
Jun 29, 2026
Sophos X-Ops reported that attackers used **covert communication channels** in a backdoor deployed against network-connected devices, allowing malicious traffic to blend into normal activity and making the intrusion harder to detect. The operation involved a backdoor designed to maintain access on compromised devices while concealing command-and-control exchanges from defenders monitoring conventional indicators. The finding highlights a stealth technique that can complicate incident response on edge infrastructure and other embedded systems, where visibility is often limited. By hiding communications inside seemingly legitimate traffic patterns, the attackers increased the likelihood of long-term persistence and reduced the chance that standard network monitoring would immediately identify the compromise.
Jul 12, 2026
Iran-linked **MuddyWater** operators have used the Dindoor backdoor after spearphishing compromises of Windows environments, targeting U.S. software and banking organizations and a Canadian non-profit. The malware abuses the legitimate signed `deno.exe` JavaScript and TypeScript runtime to execute Base64-encoded payloads, reducing the effectiveness of static and hash-based detections. The multi-stage chain inventories infected hosts, contacts a remote server, and checks for virtualized analysis environments, including PowerShell queries of `Win32_VideoController` to identify graphics hardware. Persistence is established through a Windows Run registry key that launches a VBS file—reported as `SerialLynx_system59.vbs` under a local AppData path—via `wscript.exe`; defenders should investigate anomalous Deno execution, unapproved Deno downloads using `curl.exe`, script-host activity, and Run keys invoking scripts from AppData Local.
Aug 26, 2026