Off the Beaten Path: Recent Unusual Malware
Summary: Unit 42 described three unusual malware samples from last year, including a passive IIS backdoor written in the rare C++/CLI language, with two versions compiled April 28 and May 9, 2023 and both uploaded to VirusTotal from Thailand. The later version added a custom cmd.exe wrapper to avoid spawning cmd.exe directly from an IIS process, and the samples were referred to as "Detele" in a 2024 LABScon presentation by John Southworth.
Key Takeaway: The backdoor uses hard-coded AES keys and cleartext debug strings, and Unit 42 could not attribute it to any known threat actor - so detection here depends on your own IIS and memory telemetry, not on a named adversary's known tooling.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026