Analysis Uncovers “Zenith” Backdoor Hidden in Signed QuartzLine PDF Viewer

Oct 9, 2026 · Original article ↗

Summary

Analysis of a signed QuartzLine PDF viewer found a hidden backdoor that checks in with C2 servers and can run commands or alter browser profiles. Four decrypted sessions showed no tasks; Sectigo has revoked the signing certificate.

Key points

The Windows viewer contains a hidden Rust module called “zenith,” which assigns the machine an ID and checks in with one of three C2 domains: westbeavers[.]com, motherotters[.]com, or healskills[.]com.
Code analysis shows the server can direct zenith to run Windows commands and read or replace Chromium-family browser profile files. Neither task was observed in the analyzed sessions.
Researchers decoded traffic from four of seven sandbox sessions. All four decrypted server replies indicated there was no work; three other sessions could not be decrypted.
The sample uses compression and custom scrambling inside HTTPS. The article says the method is obfuscation rather than strong cryptography.
The sample was EV-signed using a certificate issued to Guangzhou Guoying Communication Technology Co., Ltd.; Sectigo had revoked it as of 9 October 2026.
Public sandbox scores were low or clean, but the analysis says the working PDF viewer, quiet C2 behavior, and scrambled traffic obscured the backdoor’s capabilities.
The article recommends checking for %LOCALAPPDATA%\QuartzLine\terrain.dat, requests to /quarry/vein or /quarry/deposit, and command-shell or browser-restart activity from a document viewer.

Article Details

Attack Vectors: The signed Windows executable presents itself as a working PDF viewer while concealing the unrelated zenith backdoor module.
zenith checks in with its C2 over HTTPS using the paths /quarry/vein and /quarry/deposit; the traffic is additionally compressed, XOR-chained, bit-rotated, shuffled, and Base64-encoded.
According to code analysis, the server can instruct zenith to run commands through cmd /C and return their output.
According to code analysis, the server can direct zenith to read or replace browser-profile files, close the browser, and restart it with the selected profile. No such task was observed during analysis.
Defensive Notes: Look for %LOCALAPPDATA%\QuartzLine\terrain.dat and the zenith= entry in settings-style files.
Alert on POST requests to /quarry/vein or /quarry/deposit, including requests with no User-Agent header.
Watch for cmd.exe /C launched by a document viewer and for non-browser processes that run taskkill /F against a browser before restarting it with --user-data-dir.
Block the reported C2 domains and use the reported file hashes to search for the sample.
Treat a mismatch between an application's file details, signer, and displayed name as suspicious; the article reports that Sectigo revoked the certificate used to sign this sample.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`healskills[.]com`	Reported C2 domain used by zenith to check in.
DOMAIN	`motherotters[.]com`	Reported C2 domain used by zenith to check in.
DOMAIN	`westbeavers[.]com`	Reported C2 domain used by zenith to check in.
MD5	`d62d4b7811e37ce789b40ff9343e3458`	MD5 hash reported for the malicious QuartzLine sample.
SHA256	`7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3`	SHA-256 hash reported for the malicious QuartzLine sample.