Loading story…
Sophos X-Ops reported a malicious Windows backdoor that was discovered after a false-positive review of an executable signed with a valid Microsoft Windows Hardware Compatibility Publisher certificate. The malware appeared to impersonate Thales, installed itself as a service named CatalogWatcher, embedded the 3proxy proxy server, and used an XOR-obfuscated command-and-control domain, catalog[.]micrisoftdrivers[.]com. Sophos said the abuse was serious because the trusted signature could help the malware evade scrutiny and blend into enterprise environments.
Telemetry and VirusTotal data linked the backdoor to the LaiXi Android Screen Mirroring product, with related samples dating back to at least January 2023 across four compilation clusters that included signed and unsigned variants. Sophos said it found no evidence that LaiXi’s developers intentionally shipped the malware or that a broader supply-chain compromise had occurred, but urged caution because the association persisted over time. Microsoft was notified through the Microsoft Security Response Center and later added the affected files to its revocation list under CVE-2024-26234.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
In December 2023, Sophos X-Ops analyzed a malicious backdoor after a false positive report involving an executable signed with a valid Microsoft Windows Hardware Compatibility Publisher certificate. The malware installed itself as a service named CatalogWatcher and embedded the 3proxy proxy server.
Microsoft later added the relevant files to its revocation list as part of Patch Tuesday under CVE-2024-26234. This action followed Sophos's report about the signed backdoor.
After analyzing the malware, Sophos reported the abuse of the Microsoft Windows Hardware Compatibility Publisher certificate to the Microsoft Security Response Center. The backdoor used an XOR-obfuscated command-and-control domain, catalog[.]micrisoftdrivers[.]com.
Threat hunting identified related malware variants across multiple compilation clusters, with the linkage between the LaiXi Android Screen Mirroring product and the backdoor dating back to at least January 2023. Sophos said it found signed, unsigned, and differently signed samples from January through October 2023.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos researchers reported on a **signed backdoor** that blended malicious activity with deceptive on-screen behavior, using trusted code-signing to reduce suspicion and improve execution on victim systems. The malware stood out for pairing backdoor functionality with techniques designed to manipulate what users or defenders might see, suggesting an effort to hide its true behavior behind misleading visual cues while maintaining persistent remote access. The report highlights how valid or apparently trusted signatures can be abused to make malware appear legitimate, complicating detection and response. The case underscores the risk of relying too heavily on code-signing reputation alone and shows how attackers continue combining **defense evasion**, stealthy persistence, and user-facing deception to keep backdoors active inside compromised environments.
Jul 12, 2026
Attackers have been exploiting remote code execution flaws in the Sunlogin and AweSun remote-control tools to compromise exposed systems and install multiple malware families, including **PlugX** and **Sliver**. AhnLab reported that vulnerable Sunlogin versions—especially releases earlier than `11.0.0.33`—were used in campaigns tied to `CNVD-2022-10270` and `CNVD-2022-03672`, with additional payloads such as **Gh0st RAT**, **XMRig**, and **Powercat** also observed. In one intrusion, the attackers used a PowerShell-based chain and a bring-your-own-vulnerable-driver (**BYOVD**) technique leveraging `mhyprot2.sys` to disable security tools before launching a reverse shell and later deploying a Sliver implant configured for **mTLS** command-and-control. In a separate but related campaign, attackers used Sunlogin and AweSun exploitation to deliver the **PlugX** backdoor through a DLL side-loading chain. A legitimate ESET executable, `esetservice.exe`, loaded a malicious `http_dll.dll`, which decrypted and executed PlugX from `lang.dat` directly in memory. AhnLab linked the activity to infrastructure at `imango[.]ink`, including `api.imango[.]ink` and `cdn.imango[.]ink` over ports `443` and `53`. The PlugX sample matched the **BackDoor.PlugX.38** family and supported UAC bypass, service installation, process injection, plugin execution, keylogging, clipboard theft, screenshot capture, remote shell access, and RDP-based propagation, underscoring continued abuse of remote-management software vulnerabilities for persistent backdoor deployment.
Aug 15, 2026
A supply-chain compromise of **3CXDesktopApp** delivered the **SmoothOperator** malware to Windows and macOS users, turning a widely used enterprise PBX and conferencing client into a staged malware loader. SentinelLabs reported that trojanized Windows installers triggered detections after a spike in malicious activity, with the application loading shellcode, reflectively loading DLLs, retrieving poisoned `.ico` files from GitHub containing appended Base64 data, decrypting a command-and-control URL, and ultimately deploying a third-stage infostealer that harvested host information and browser history. On macOS, investigators found a malicious `libffmpeg.dylib` embedded in the installer; it was code-signed and notarized at discovery, then later revoked by Apple. Technical analysis of the Windows payload chain showed a two-DLL staging process in which an initial DLL acted as a PE loader for `d3dcompiler_47.dll`, searched for a marker in its Security directory, unpacked shellcode, and mapped an in-memory 64-bit DLL before transferring execution to `DllGetClassObject`. Researchers noted API hashing consistent with Metasploit-style routines, a hard-coded **3CXDesktopApp** user-agent string, and possible anti-emulation logic using `cpuid`. On macOS, the first stage collected environment data, contacted a hardcoded C2, and dropped **UpdateAgent**, which gathered 3CX account and provisioning details before self-deleting. Mandiant later said the backdoor on 3CX’s macOS build server was **POOLRAT**, not **SIMPLESEA**, linking the intrusion to malware previously associated with **Lazarus** activity, though attribution remained cautious at the time.
Aug 21, 2026