Loading story…
Elastic Security Labs identified BITSLOTH, a previously undocumented Windows backdoor deployed after lateral movement in an intrusion against a South American government’s Foreign Ministry. Attackers executed the payload through DLL side-loading using a signed FL Studio executable and used public tooling including RINGQ, IOX, STOWAWAY, GodPotato, Mimikatz, PPLFault, and Certify.
BITSLOTH abuses the Windows Background Intelligent Transfer Service (BITS)—a legitimate Windows component commonly accessed through COM interfaces—for command-and-control communications, file transfers, and persistence. The backdoor can perform host discovery, execute commands, manage processes and services, capture screenshots, and log keystrokes, indicating an intelligence-collection objective. Development artifacts date to December 2021 and contain Simplified Chinese strings and terminology, although the responsible threat actor has not been identified.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
BITSLOTH samples contained development artifacts indicating that the Windows backdoor family had been under development since at least December 2021.
Researchers observed the previously undocumented BITSLOTH backdoor during intrusion REF8747 targeting the Foreign Ministry of a South American government. The operators moved laterally, used PsExec, and DLL-side-loaded BITSLOTH through a signed FL Studio executable.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a targeted multi-stage malware campaign that compromised victims through watering hole attacks and exploitation of **`CVE-2018-8174`**, a zero-day VBScript use-after-free flaw triggered through Internet Explorer’s rendering engine. The exploit chain, previously documented as being deliverable through malicious Office content that forced **`mshtml.dll`** to load remote HTML and obfuscated VBScript, enabled shellcode execution and helped attackers install a downloader followed by a custom backdoor dubbed **SLUB**. Once deployed, SLUB used legitimate cloud and collaboration services to hide command-and-control and data theft activity. The malware retrieved commands from a **GitHub Gist**, sent execution results to private **Slack** channels using embedded API tokens, and uploaded stolen files to **file.io**. Trend Micro said the downloader also checked for antivirus processes and exploited **`CVE-2015-1701`** for local privilege escalation, while the backdoor persisted via a Run registry key and **`rundll32.exe`**. The operation appeared focused on collecting person-related information and communications data, including content from **Skype**, **KakaoTalk**, **Twitter**, bulletin board systems, and **HWP** documents; GitHub and Slack removed the malicious infrastructure after notification.
Aug 15, 2026
Researchers disclosed **TASK#STOMP**, a VBScript-led, PowerShell-based Windows backdoor built for corporate espionage. The malware inventories and exfiltrates business documents, watches for newly created or modified files, steals saved Wi-Fi passwords and clipboard contents, captures screenshots and system metadata, and allows operators to run arbitrary PowerShell commands. Its components communicate with redundant command-and-control domains using a hardcoded authentication token. TASK#STOMP maintains access through four masquerading scheduled tasks and a Startup-folder script, with two PowerShell components configured to monitor one another; partial remediation may therefore permit reinfection. The malware also uses hidden execution, timestomping, native Windows utilities, process control, and cleanup mechanisms to frustrate detection and forensic analysis. Researchers observed an Iranian government-tender website opened in Chrome by the orchestrator, though its purpose is unknown; the campaign's delivery method, scope, duration, and responsible actor remain unconfirmed.
Sep 22, 2026
Elastic Security Labs reported an intrusion at a South Asian financial institution involving two custom malware families: **BRUSHWORM**, a modular backdoor deployed as `paint.exe`, and **BRUSHLOGGER**, a keylogger masquerading as `libcurl.dll`. BRUSHWORM established persistence through scheduled tasks, contacted a command-and-control server, downloaded additional DLL payloads, and stole files including documents, spreadsheets, email archives, and source code. The malware also spread through removable media, giving the operator a way to move data and malware across disconnected environments. BRUSHLOGGER was delivered through **DLL side-loading** and used a low-level keyboard hook to capture system-wide keystrokes along with active window context, storing XOR-obfuscated logs under `C:\programdata\Photoes\`. Elastic said the tooling showed relatively low sophistication, with basic anti-analysis checks and an AES-CBC encrypted configuration using a hardcoded key, but still provided a functional collection platform for persistence, credential and data theft, USB propagation, and air-gap bridging. Earlier samples such as `V1.exe`, `V2.exe`, and `V4.exe` found on VirusTotal suggested the malware had been iteratively developed by the threat actor.
Jun 29, 2026