New Shrouded Snooper actor targets telecommunications firms in the Middle East with novel Implants
Summary: Cisco Talos attributed a new intrusion set it calls ShroudedSnooper to two implants, HTTPSnoop and PipeSnoop, found masquerading as Palo Alto Networks Cortex XDR components under the filename CyveraConsole.exe, with compile timestamps tampered to pose as XDR agent version 7.8.0.64264, a version released Aug. 7, 2022 and decommissioned April 24, 2023, with one implant compiled Nov. 16, 2022. HTTPSnoop is a backdoor that binds to HTTP(S) URL patterns via low-level Windows APIs and http.sys to receive base64-encoded shellcode and execute it, with variants crafted April 17, April 19 and April 29, 2023, while PipeSnoop, created in May 2023, reads shellcode from a pre-existing named IPC pipe and cannot run standalone.
Bottom line: The implants' URL patterns mimic Microsoft Exchange Web Services, OfficeTrack (marketed especially to telecommunications firms), and provisioning services of an Israeli telecommunications company, placing internet-exposed web and EWS servers at the edge of a campaign aimed at a sector Talos says was consistently a top-targeted vertical in its 2022 IR engagements.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026