New Tor Net backdoor seen in widespread campaign
Summary: Cisco Talos reported a phishing campaign, mostly in Polish and German, that delivers .tgz attachments containing a .NET loader which pulls AES-encrypted PureCrypter malware from compromised staging servers and, in some intrusions, drops a new .NET backdoor Talos calls TorNet. TorNet connects to a C2 server on ports 8194, 7890, or 8410, can run arbitrary .NET assemblies in memory, and downloads the TOR expert bundle to route backdoor traffic through the TOR network via SocksPort 127.0.0.1:9050.
Key Takeaway: The backdoor can receive and reflectively execute arbitrary .NET assemblies from its C2, so a single infection becomes a foothold for whatever the actor sends next, while TOR-routed traffic and PureCrypter's DHCP release-and-renew step are designed to slip past cloud-based anti-malware.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026