StingyBasilisk moves malware over SMB and named pipes
Custom in-memory DLL agents relay commands so hosts without Internet can still be controlled.
73
Threat actor
StingyBasilisk
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 13, 2026
- Last mentioned1d ago
Timeline
2 articles · newest firstStingyBasilisk uses named pipes, COM hijacking, and time providers
The espionage group has been in a victim network since at least April 2022; the initial access vector is unknown.
74
Appears with
- Microsoftvendor · 2
- Positive Technologiesorganization · 2
- CunningDoormalware · 2
- SilentCOMmalware · 2
- Windowsproduct · 2
- TediousLoadermalware · 2
- HenMapCaConmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.