Security researchers discovered threat actors using an undocumented backdoor dubbed Win32/StealthFalcon to exfiltrate data to remote servers and run code on infected hosts.

According to the report from ESET, Win32/StealthFalcon is likely the work of a state-sponsored threat group that has previously been identified by several names, including Stealth Falcon and Project Raven. Win32/StealthFalcon may have been developed back in 2015 and has already been used in malware attacks against users in Thailand, Saudi Arabia, the United Arab Emirates (UAE) and the Netherlands. The undocumented backdoor bears similarities to another one the group wrote in PowerShell.

Breaking In Through BITS

Win32/StealthFalcon is notable in the way it abuses a standard component in Microsoft Windows: the Background Intelligent Transfer Service (BITS).

Best known as a mechanism for software vendors to provide automatic updates while a machine is not using its network connection, researchers believe Win32/StealthFalcon hid command-and-control (C&C) traffic within BITS. That not only allowed its malware to bypass firewalls, but may have duped security teams that would not have suspected such traffic as being malicious.

The group used a hardcoded key with RC4 to encrypt network communication from the compromised host and campaignID/target ID as a host identifier. This was the same approach StealthFalcon took with the backdoor it had created in PowerShell, which researchers said had very similar code to Win32/StealthFalcon.

Besides offering hackers an alternative to communicating with a C&C server using HTTP or HTTPS requests, researchers said BITS has the advantage of working during downtime periods and is harder to detect with security tools because it is exposed through a COM interface. Depending on what kind of bandwidth is needed to transfer files, BITS can also adjust the rate at which it works, making any unauthorized activity less noticeable.

How to Close an Undocumented Backdoor Like Win32/StealthFalcon

While an undocumented backdoor like Win32/StealthFalcon is deliberately harder to spot, IBM experts suggest organizations stand a better chance of detecting and responding to security threats by analyzing network flow data. This reduces false positives, offers greater visibility than log data and cannot be tampered with by cybercriminals.

Meanwhile, since humans might not always pay attention to unusual BITS activity, intrusion detection and prevention tools can offer a more automated and reliable way to identify groups such as Stealth Falcon as early as possible.

More from

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…

The Growing Risks of Shadow IT and SaaS Sprawl

4 min read - In today's fast-paced digital landscape, there is no shortage of apps and Software-as-a-Service (SaaS) solutions tailored to meet the diverse needs of businesses across different industries. This incredible array of options has revolutionized how we work, providing cost-effective and user-friendly tools that streamline tasks and boost productivity. However, this ever-expanding application ecosystem comes with its challenges: namely, shadow IT and SaaS sprawl. According to a recent study by Entrust, 77% of IT professionals are concerned about shadow IT becoming a…

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging. We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically. For this reason, 75% of organizations…