TorNet Backdoor Uses Tor for Stealthy Command-and-Control in Phishing Campaign
Summary
Cisco Talos analyzed a campaign targeting users mainly in Poland and Germany. Phishing attachments deliver PureCrypter, which can install the TorNet backdoor for persistent access, Tor-routed command-and-control, and execution of remote .NET assemblies.
Key points
- The campaign has operated since at least July 2024 and uses phishing emails impersonating financial, manufacturing, and logistics organizations.
- Victims are prompted to open .tgz attachments and run a .NET loader, which delivers PureCrypter.
- PureCrypter uses anti-analysis checks, adds Windows Defender exclusions, and establishes persistence through registry, scheduled-task, and startup-folder mechanisms.
- The malware briefly disconnects and reconnects the victim machine, a technique Talos says may evade cloud-based antimalware detection.
- TorNet connects to command-and-control servers and routes its traffic through the Tor network; it can receive and execute arbitrary .NET assemblies in memory.
- Talos published indicators of compromise and detection coverage, including Snort rules and ClamAV signatures.
Article Details
- Attack Vectors
- Phishing emails impersonating financial institutions and manufacturing or logistics companies, with fake money-transfer confirmations or order receipts; samples were predominantly in Polish and German, with some in English.
- Compressed .tgz email attachments containing a .NET loader, which downloads encrypted PureCrypter from compromised websites or loads an embedded copy.
- PureCrypter drops and runs the TorNet backdoor; TorNet communicates with its C2 and can receive and execute arbitrary .NET assemblies in memory.
- Defensive Notes
- Talos reports that Cisco Secure Endpoint can prevent execution of the described malware, and Cisco Secure Email can block the campaign’s malicious emails.
- Cisco Secure Web Appliance and Cisco Secure Firewall products are described as detecting or blocking activity associated with the threat.
- The article lists Snort SIDs 64440, 64439, 64437, 64438, and 301115, and reports available ClamAV detections for TorNet.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]168[.]7[.]37 | IP address to which the TorNet C2 domains resolved during Talos's research. |
MITRE ATT&CK
T1053.005 · Scheduled TaskPureCrypter creates a Windows scheduled task that runs the loader every two to four minutes.T1055 · Process InjectionPureCrypter injects the dropped TorNet backdoor into a .NET runtime executable process.T1090.003 · Multi-hop ProxyTorNet routes its backdoor-process traffic through the TOR network to anonymize C2 communications.T1105 · Ingress Tool TransferThe loader downloads encrypted PureCrypter from a remote staging server.T1204.002 · Malicious FileThe user must open the compressed attachment, manually unzip it, and run the .NET loader.T1547.001 · Registry Run Keys / Startup FolderPureCrypter establishes persistence by adding the loader path to the Run registry key.T1562.001 · Disable or Modify ToolsPureCrypter adds its process and the dropped backdoor path to Windows Defender exclusion lists.T1566.001 · Spearphishing AttachmentThe campaign begins with phishing emails carrying malicious attachments.T1620 · Reflective Code LoadingTorNet reflectively loads and runs received .NET assemblies in memory.
Malware
Agent TeslaThe actor has delivered different payloads, including Agent Tesla, Snake Keylogger, and a new undocumented backdoor we are calling TorNet, dropped by PureCrypter malware. PureCrypterThe actor has delivered different payloads, including Agent Tesla, Snake Keylogger, and a new undocumented backdoor we are calling TorNet, dropped by PureCrypter malware. Snake KeyloggerThe actor has delivered different payloads, including Agent Tesla, Snake Keylogger, and a new undocumented backdoor we are calling TorNet, dropped by PureCrypter malware. TorNetNew TorNet backdoor seen in widespread campaign
Products
Microsoft WindowsThe actor is running a Windows scheduled task on victim machines—including on endpoints with a low battery—to achieve persistence. Windows DefenderIt modifies the Windows Defender settings by executing the PowerShell commands to add its process and the path of the dropped backdoor to the exclusion lists.
Tools
.NET ReactorPureCrypter malware found in this intrusion is a Windows dynamic-link library obfuscated with Eziriz’s .NET Reactor obfuscator. It has resources of encrypted binaries of legitimate DLLs, including Protobuf-net andClamAVClamAV detections are also available for this threat: SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 64440, 64439, 64437, 64438 and 301115.
Countries
Germanymotivated threat actor since as early as July 2024 targeting users, predominantly in Poland and Germany, based on the phishing email language. Polandby a financially motivated threat actor since as early as July 2024 targeting users, predominantly in Poland and Germany, based on the phishing email language.
Industries
financialThe intrusions start with a phishing email as the initial infection vector. The actor is impersonating financial institutions and manufacturing and logistics companies by sending fake money transfer confirmations andlogisticsthe initial infection vector. The actor is impersonating financial institutions and manufacturing and logistics companies by sending fake money transfer confirmations and fake order receipts, respectively. TheManufacturingphishing email as the initial infection vector. The actor is impersonating financial institutions and manufacturing and logistics companies by sending fake money transfer confirmations and fake order receipts,