September 10, 2019 By Shane Schick 2 min read

Security researchers discovered threat actors using an undocumented backdoor dubbed Win32/StealthFalcon to exfiltrate data to remote servers and run code on infected hosts.

According to the report from ESET, Win32/StealthFalcon is likely the work of a state-sponsored threat group that has previously been identified by several names, including Stealth Falcon and Project Raven. Win32/StealthFalcon may have been developed back in 2015 and has already been used in malware attacks against users in Thailand, Saudi Arabia, the United Arab Emirates (UAE) and the Netherlands. The undocumented backdoor bears similarities to another one the group wrote in PowerShell.

Breaking In Through BITS

Win32/StealthFalcon is notable in the way it abuses a standard component in Microsoft Windows: the Background Intelligent Transfer Service (BITS).

Best known as a mechanism for software vendors to provide automatic updates while a machine is not using its network connection, researchers believe Win32/StealthFalcon hid command-and-control (C&C) traffic within BITS. That not only allowed its malware to bypass firewalls, but may have duped security teams that would not have suspected such traffic as being malicious.

The group used a hardcoded key with RC4 to encrypt network communication from the compromised host and campaignID/target ID as a host identifier. This was the same approach StealthFalcon took with the backdoor it had created in PowerShell, which researchers said had very similar code to Win32/StealthFalcon.

Besides offering hackers an alternative to communicating with a C&C server using HTTP or HTTPS requests, researchers said BITS has the advantage of working during downtime periods and is harder to detect with security tools because it is exposed through a COM interface. Depending on what kind of bandwidth is needed to transfer files, BITS can also adjust the rate at which it works, making any unauthorized activity less noticeable.

How to Close an Undocumented Backdoor Like Win32/StealthFalcon

While an undocumented backdoor like Win32/StealthFalcon is deliberately harder to spot, IBM experts suggest organizations stand a better chance of detecting and responding to security threats by analyzing network flow data. This reduces false positives, offers greater visibility than log data and cannot be tampered with by cybercriminals.

Meanwhile, since humans might not always pay attention to unusual BITS activity, intrusion detection and prevention tools can offer a more automated and reliable way to identify groups such as Stealth Falcon as early as possible.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today