A newly uncovered Windows backdoor is giving an East Asia-linked espionage operation a quiet way to deepen control inside targeted networks.
Named BINDCLOAK, the modular implant is deployed after initial access and can run malware using more powerful user or process accounts.
The campaign targeted government entities in the Middle East, with a particular focus on the energy sector.
Attackers used a multi-stage chain that began with an ISO file and legitimate-looking Windows components before delivering TELESHIM, MIXEDKEY, and finally BINDCLOAK.
A related report on Telegram bot backdoor controllers explains how the earlier TELESHIM component helped operators manage compromised systems.
Analysts at Zscaler identified BINDCLOAK as a previously undocumented 64-bit Windows backdoor written in C.
Zscaler said in a report shared with Cyber Security News (CSN) that the malware was decrypted and reflectively loaded by MIXEDKEY during post-compromise activity.
The discovery shows how attackers can turn stolen Windows access tokens into a practical privilege escalation tool.
Instead of relying only on a software flaw, BINDCLOAK collects available tokens and uses them to launch its modules with the rights of a more privileged account.
BINDCLOAK has commands to collect user tokens, inspect running processes, and identify tokens that can be copied or assigned to new processes.
It can attempt to log in with supplied credentials, retain a successful user token, and later use that token to start a selected module.
The backdoor also examines active processes for their IDs, account details, and token permissions.
That allows the operator to select a process token that may offer stronger access, then duplicate it and start a BINDCLOAK module in that security context.
This approach is especially dangerous because access-token abuse can blend into normal Windows behavior.
Recent Windows privilege escalation research has also shown how gaining SYSTEM-level access can give an attacker broad control of an affected machine.
Once a module receives a higher-privileged token, BINDCLOAK calls the Windows ImpersonateLoggedOnUser function so its activity runs under that account.
The malware can also stop, remove, and replace modules, helping operators adjust their tools without reinstalling the full backdoor.
BINDCLOAK communicates with its command server through TLS over TCP, using a custom message-routing system.
Its messages are compressed, encrypted twice with rolling XOR keys, padded with random data, and then delivered to the relevant internal module.
The malware collects a wide range of host information for its first beacon, including the operating-system version, computer name, username, hostname, local IP address, and local time.
This gives attackers a quick view of each infected system before they decide which commands or plugins to deploy.
Its plugin loader creates memory with read, write, and execute permissions, then loads additional DLL modules directly into memory.
To avoid alerts, it uses RtlQueueWorkItem to invoke LoadLibraryW, a technique intended to make suspicious loading behavior less obvious to endpoint security tools.
Similar concerns apply when attackers abuse legitimate processes for malicious DLL payload injection, which can hide code behind trusted Windows activity.
Researchers assessed with high confidence that BINDCLOAK is a variant of the OctLurk backdoor, citing code similarities and overlapping command-and-control infrastructure.
The same operator appears to have expanded from Central Asia into Middle Eastern targets, underscoring the need to review abnormal token use, unexpected DLL loading, and suspicious outbound TLS connections.
Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.
Monitoring anomalous process-token access and reviewing suspicious web-server activity can also support broader cross-platform intrusion investigations.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…