September 10, 2019 By Shane Schick 2 min read

Security researchers discovered threat actors using an undocumented backdoor dubbed Win32/StealthFalcon to exfiltrate data to remote servers and run code on infected hosts.

According to the report from ESET, Win32/StealthFalcon is likely the work of a state-sponsored threat group that has previously been identified by several names, including Stealth Falcon and Project Raven. Win32/StealthFalcon may have been developed back in 2015 and has already been used in malware attacks against users in Thailand, Saudi Arabia, the United Arab Emirates (UAE) and the Netherlands. The undocumented backdoor bears similarities to another one the group wrote in PowerShell.

Breaking In Through BITS

Win32/StealthFalcon is notable in the way it abuses a standard component in Microsoft Windows: the Background Intelligent Transfer Service (BITS).

Best known as a mechanism for software vendors to provide automatic updates while a machine is not using its network connection, researchers believe Win32/StealthFalcon hid command-and-control (C&C) traffic within BITS. That not only allowed its malware to bypass firewalls, but may have duped security teams that would not have suspected such traffic as being malicious.

The group used a hardcoded key with RC4 to encrypt network communication from the compromised host and campaignID/target ID as a host identifier. This was the same approach StealthFalcon took with the backdoor it had created in PowerShell, which researchers said had very similar code to Win32/StealthFalcon.

Besides offering hackers an alternative to communicating with a C&C server using HTTP or HTTPS requests, researchers said BITS has the advantage of working during downtime periods and is harder to detect with security tools because it is exposed through a COM interface. Depending on what kind of bandwidth is needed to transfer files, BITS can also adjust the rate at which it works, making any unauthorized activity less noticeable.

How to Close an Undocumented Backdoor Like Win32/StealthFalcon

While an undocumented backdoor like Win32/StealthFalcon is deliberately harder to spot, IBM experts suggest organizations stand a better chance of detecting and responding to security threats by analyzing network flow data. This reduces false positives, offers greater visibility than log data and cannot be tampered with by cybercriminals.

Meanwhile, since humans might not always pay attention to unusual BITS activity, intrusion detection and prevention tools can offer a more automated and reliable way to identify groups such as Stealth Falcon as early as possible.

More from

White House cements CISA’s role as national coordinator for cybersecurity

2 min read - In 2013, the Obama Administration rolled out "The Presidential Policy Directive (PPD) on Critical Infrastructure Security and Resilience", a forerunner to the Cybersecurity and Infrastructure Security Agency (CISA), created "to strengthen and maintain secure, functioning and resilient critical infrastructure."The directive was groundbreaking in 2013, noting the importance of the rising risk of cyberattacks against critical infrastructure. But as cyber risks are constantly shifting, every cybersecurity program needs to be re-evaluated, and CISA is no exception. That’s why, in April 2024, President…

How a new wave of deepfake-driven cybercrime targets businesses

5 min read - As deepfake attacks on businesses dominate news headlines, detection experts are gathering valuable insights into how these attacks came into being and the vulnerabilities they exploit.Between 2023 and 2024, frequent phishing and social engineering campaigns led to account hijacking and theft of assets and data, identity theft, and reputational damage to businesses across industries.Call centers of major banks and financial institutions are now overwhelmed by an onslaught of deepfake calls using voice cloning technology in efforts to break into customer…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today