Security researchers discovered threat actors using an undocumented backdoor dubbed Win32/StealthFalcon to exfiltrate data to remote servers and run code on infected hosts.

According to the report from ESET, Win32/StealthFalcon is likely the work of a state-sponsored threat group that has previously been identified by several names, including Stealth Falcon and Project Raven. Win32/StealthFalcon may have been developed back in 2015 and has already been used in malware attacks against users in Thailand, Saudi Arabia, the United Arab Emirates (UAE) and the Netherlands. The undocumented backdoor bears similarities to another one the group wrote in PowerShell.

Breaking In Through BITS

Win32/StealthFalcon is notable in the way it abuses a standard component in Microsoft Windows: the Background Intelligent Transfer Service (BITS).

Best known as a mechanism for software vendors to provide automatic updates while a machine is not using its network connection, researchers believe Win32/StealthFalcon hid command-and-control (C&C) traffic within BITS. That not only allowed its malware to bypass firewalls, but may have duped security teams that would not have suspected such traffic as being malicious.

The group used a hardcoded key with RC4 to encrypt network communication from the compromised host and campaignID/target ID as a host identifier. This was the same approach StealthFalcon took with the backdoor it had created in PowerShell, which researchers said had very similar code to Win32/StealthFalcon.

Besides offering hackers an alternative to communicating with a C&C server using HTTP or HTTPS requests, researchers said BITS has the advantage of working during downtime periods and is harder to detect with security tools because it is exposed through a COM interface. Depending on what kind of bandwidth is needed to transfer files, BITS can also adjust the rate at which it works, making any unauthorized activity less noticeable.

How to Close an Undocumented Backdoor Like Win32/StealthFalcon

While an undocumented backdoor like Win32/StealthFalcon is deliberately harder to spot, IBM experts suggest organizations stand a better chance of detecting and responding to security threats by analyzing network flow data. This reduces false positives, offers greater visibility than log data and cannot be tampered with by cybercriminals.

Meanwhile, since humans might not always pay attention to unusual BITS activity, intrusion detection and prevention tools can offer a more automated and reliable way to identify groups such as Stealth Falcon as early as possible.