Steg Baus: Because Sometimes XOR Just Isn’t Enough
Summary: Palo Alto Networks' Unit 42 identified a .NET loader it calls StegBaus that hides its configuration and final payload in embedded PNG images using custom steganography, then applies AES-128 encryption twice before loading the payload into memory via RunPE. The loader was first seen on December 30, 2016, and has been used to deliver commodity families including DarkComet, LuminosityLink RAT, Pony, and ImmenentMonitor, with more than 250 samples found in WildFire.
What's compelling: The families StegBaus delivers have been behind large numbers of prior infections, and the loader's image-based hiding and double AES layer mean signature and static checks that expect readable configuration data will miss it before execution.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026