Houdini’s Magic Reappearance
Summary: Unit 42 documented a new version of the Hworm (Houdini) backdoor used in an ongoing campaign, with samples first observed in June 2016 and attacks still seen as recently as mid-October. The SFX delivery files carried Arabic filenames themed on Middle East and Mediterranean political figures and groups, opened decoy documents, videos, or URLs, and executed packed Hworm payloads that beaconed to one of three command-and-control locations.
What's compelling: The samples used a mixed binary and ASCII TCP protocol containing the string "new_houdini" rather than the older HTTP delimiter-based beaconing, so signatures tuned to prior Hworm traffic would not have caught it. Unit 42 also notes the RAT is available in semi-public locations, meaning the same tool can serve both surgical threat actors and casual compromises.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026