A recent discovery by Positive Technologies has revealed a new cyber espionage group named StingyBasilisk, which has been leveraging Windows named pipes and the SMB protocol to propagate malware across highly segmented networks. The group has been operational since at least April 2022, employing stealth tactics to remain undetected within victim systems, masquerading as legitimate security tools.
Infiltration Tactics and Network Penetration
Analysts have been unable to determine the initial entry point of the attackers, yet they discovered a sophisticated network of custom agents controlled via Windows named pipes. This standard Windows feature facilitates inter-process communication, allowing the malicious traffic to blend seamlessly with normal network activities. The operation’s covert nature suggests that espionage is its primary intent.
According to findings published on Habr, each malware instance is a DLL designed to execute in-memory payloads, leaving no traces on disk. The group appears to employ a proprietary command-and-control framework, and no known adversary has been conclusively linked to these activities.
Propagation and Execution Strategies
Beginning in February 2026, the group expanded its reach within compromised networks by distributing malware through SMB, storing malicious files in the C:WindowsTemp directory. Remote execution was achieved using the atexec tool from the Impacket toolkit, which interfaces with the Windows Task Scheduler over SMB to initiate tasks.
By creating tasks with GUID-like names, differing from Impacket’s default script, the attackers introduced a subtle marker for defenders to identify. This phase involved deploying the CunningDoor loader using rundll32 to execute a signed SafeNet library, subsequently loading a malicious DLL.
Persistence and Network Navigation
The attackers employed two unique persistence methods to maintain their foothold post-reboot. The first involved COM hijacking, altering registry keys for network components to load their DLLs clandestinely. This mechanism, dubbed SilentCOM, ensures stability by passing legitimate calls through the fake libraries.
The second method exploited the Windows Time service, adding a custom provider under the registry’s W32Time section. This allowed their DLL, TediousLoader, to be loaded with System-level privileges at every boot, facilitating raw socket operations and packet monitoring for encrypted command execution.
To counter these threats, cybersecurity teams are advised to monitor named pipe traffic for known patterns, restrict SMB traffic between network segments, log task creation, and scrutinize registry modifications and unusual DLL presence. Such vigilance is crucial in anticipating and disrupting these sophisticated cyber threats.
