Zardoor Backdoor Used in Long-Running Espionage Campaign Against Saudi Nonprofit
Summary
Cisco Talos details a campaign active since at least 2021 that used the Zardoor backdoor, Windows utilities and reverse-proxy tools to maintain access to a Saudi Islamic nonprofit and periodically exfiltrate data.
Key points
- Talos observed the campaign targeting an Islamic charitable nonprofit in Saudi Arabia; initial access is unknown, and the threat actor remains unattributed.
- The campaign was likely active since at least March 2021. Talos found one compromised target and observed data exfiltration about twice a month.
- Zardoor comprises zar32.dll, an HTTP/SSL remote-access backdoor, and zor32.dll, which helps deploy it and maintain persistence.
- The malware abuses Windows components including msdtc.exe, rundll32.exe and WMI, and uses DLL side-loading and scheduled tasks for persistence.
- FRP, sSocks and Venom reverse-proxy tools were used for command-and-control and remote access; SSH port forwarding was also observed.
- Talos assesses links to known China-origin threat groups with low confidence and does not attribute the campaign to a known actor.
- Talos published Snort rules and ClamAV signatures to detect activity and malware artifacts associated with the campaign.
Article Details
- Attack Vectors
- The initial access vector is unknown.
- The actor used WMI to spawn processes on the target and execute commands received from C2, enabling lateral movement and tool deployment.
- The actor used scheduled tasks named "KasperskySecurity" or "Microsoft Security Essentialss" to run the proxy executable msbuildss.exe approximately every 20 minutes; the article says the actor deleted legitimate tasks with those names before replacing them.
- The actor used SSH remote port forwarding from port 443 on the victim device to port 22 on the attacker’s server, with shd.exe and a downloaded private key.
- The actor deployed the Zardoor backdoor through a malicious oci.dll loaded by msdtc.exe, then launched zar32.dll and zor32.dll with rundll32.exe.
- The actor used reverse-proxy tools including FRP, customized sSocks, and Venom to establish C2 and remote access.
- Defensive Notes
- Cisco Talos notes that an FRP client in an environment where FRP is not typically used may indicate a potential compromise.
- The article lists Cisco Secure Endpoint, Secure Email, Secure Firewall, Secure Network/Cloud Analytics, Secure Malware Analytics, Umbrella, Secure Web Appliance, Cisco Duo, Snort rules, and ClamAV signatures as detection or prevention coverage.
- Snort SIDs listed for this threat are 61913, 61914, and 62371–62380.
- ClamAV signatures listed are Win.Backdoor.Zardoor-10019732-0, Win.Backdoor.ZardoorVMP-10019731-0, Win.Backdoor.sSocksProxy-10019733-0, and Win.Backdoor.VenomProxy-10019734-0.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 70[.]34[.]208[.]197 | Remote server IP used by the actor for SSH remote port forwarding. |
MITRE ATT&CK
T1018 · Remote System DiscoveryThe article lists remote system discovery among techniques associated with the observed activity.T1033 · System Owner/User DiscoveryThe article lists system owner/user discovery among techniques associated with the observed activity.T1047 · Windows Management InstrumentationThe actor used WMI to spawn processes on the target and execute commands received from C2.T1048 · Exfiltration Over Alternative ProtocolThe article reports recurring data exfiltration from the compromised organization, approximately twice a month.T1049 · System Network Connections DiscoveryThe article lists system network connections discovery among techniques associated with the observed activity.T1053.005 · Scheduled TaskThe actor registered reverse proxies as scheduled tasks, replacing tasks with familiar security-product names.T1055 · Process InjectionThe article lists process injection among techniques associated with the activity.T1055.001 · Dynamic-link Library InjectionThe article lists DLL injection among techniques associated with the activity.T1057 · Process DiscoveryThe article lists process discovery among techniques associated with the observed activity.T1059.003 · Windows Command ShellThe article lists Windows Command Shell among techniques associated with the activity, including command execution and batch-file cleanup.T1070.004 · File DeletionThe dropper and cleanup batch script deleted themselves and other files.T1087.002 · Domain AccountThe article lists domain account discovery among techniques associated with the observed activity.T1090.003 · Multi-hop ProxyThe actor used reverse-proxy tools including Venom, described as supporting multi-hop proxying.T1105 · Ingress Tool TransferThe actor downloaded a private SSH key and used remote tools and payloads in the campaign.T1204.002 · Malicious FileThe article lists user execution of a malicious file among techniques associated with the activity.T1574.002 · DLL Side-LoadingThe actor used msdtc.exe to load the malicious oci.dll, which carried Zardoor backdoor components.
People
Malware
Vendors
Products
Cisco DuoCisco Duo provides multi-factor authentication for users to ensure only those authorized are accessing your network. Cisco Secure EmailCisco Secure Email (formerly Cisco Email Security) can block malicious emails sent by threat actors as part of their campaign. You can try Secure Email for free here.Cisco Secure EndpointCisco Secure Endpoint (formerly AMP for Endpoints) is ideally suited to prevent the execution of the malware detailed in this post. Try Secure Endpoint for free here.Cisco Secure FirewallCisco Secure Firewall (formerly Next-Generation Firewall and Firepower NGFW) appliances such as Threat Defense Virtual, Adaptive Security Appliance and Meraki MX can detect malicious activity associated with this threat.Cisco Secure Malware AnalyticsCisco Secure Malware Analytics (formerly Threat Grid) identifies malicious binaries and builds protection into all Cisco Secure products.Cisco Secure Network/Cloud AnalyticsCisco Secure Network/Cloud Analytics (Stealthwatch/Stealthwatch Cloud) analyzes network traffic automatically and alerts users of potentially unwanted activity on every connected device.Cisco Secure Web ApplianceCisco Secure Web Appliance (formerly Web Security Appliance) automatically blocks potentially dangerous sites and tests suspicious sites before users access them. ClamAVThe following ClamAV signatures have been released to detect malware artifacts related to this threat:UmbrellaUmbrella, Cisco’s secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network. Sign up for a free trial of Umbrella here.
Tools
Earthworm (ew)Earthworm (ew)Fast Reverse Proxy (FRP)Then we observed the threat actor establishing C2 using open-source reverse proxy tools such as Fast Reverse Proxy (FRP), sSocks and Venom, a reverse proxy socks5 server-client tool originally developed forGo socks5Go socks5HTran (lcx)HTran (lcx)IOXioxNATBypassNATBypassNPSNPSreGeorgRegeorgRSocxRsocxRundll32The threat actor then uses Rundll32 to execute the patched “oci.dll” using this command: C:\Windows\System32\rundll32.exe %TEMP%\win_oci_41aa0d5.dll MainEntry. This patched “oci.dll” will extract “zar32.dll” andshd.exeThe executable “shd.exe” initiates an SSH connection using the username root and the password "3My[{BK)Ni8a".SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org. Snort SIDs for this threat are 61913, 61914 and 62371 - 62380.sSocksthe threat actor establishing C2 using open-source reverse proxy tools such as Fast Reverse Proxy (FRP), sSocks and Venom, a reverse proxy socks5 server-client tool originally developed for penetration testers. Venomactor establishing C2 using open-source reverse proxy tools such as Fast Reverse Proxy (FRP), sSocks and Venom, a reverse proxy socks5 server-client tool originally developed for penetration testers. Windows Management Instrumentation (WMI)Once a connection was established, the threat actor used Windows Management Instrumentation (WMI) to move laterally and spread the attacker's tools — including Zardoor — by spawning processes on the target system and