New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization
Summary: Cisco Talos discovered in May 2023 an espionage campaign against an Islamic charitable non-profit in Saudi Arabia that exfiltrates data roughly twice a month, using a previously unseen backdoor family named Zardoor after its files zar32.dll and zor32.dll. The actor established command-and-control through open-source reverse proxy tools including Fast Reverse Proxy, sSocks and Venom, moved laterally with Windows Management Instrumentation, and registered the proxies as scheduled tasks named to mimic KasperskySecurity or Microsoft Security Essentialss so they run about every 20 minutes.
Bottom line: The intrusion relied on legitimate, widely used tools - FRP, sSocks, Venom - and on hijacking the names of security products' scheduled tasks, so the traffic and the task list look ordinary; Talos notes an FRP client in an environment where it is not normally used may itself be an indicator of compromise.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026