StingyBasilisk moves malware over SMB and named pipes
Original title: Hackers Use Windows Named Pipes and SMB to Spread Malware Across Isolated Government Networks
Custom in-memory DLL agents relay commands so hosts without Internet can still be controlled.
Positive Technologies says StingyBasilisk has been active since at least April 2022 and stayed quiet while posing as the victim's security tools. From February 2026 it copied malware over SMB into C:\Windows\Temp and started it with Impacket atexec. Named-pipe chains, COM hijacking, a Windows Time provider, and SafeNet DLL side-loading reach isolated segments. Initial access was not found, and no known group was reliably linked.
Unconfirmed: How the attackers first entered is unknown, and attribution to any known group is not established.
- Task names looked like random GUIDs rather than Impacket's default.
- SilentCOM hijacks Network List Manager and Network Configuration TreatAs keys.
- TediousLoader waits for a signed packet, then runs AES-256-decrypted code in memory.
- CunningDoor side-loads through signed SafeNet libraries started with rundll32.
- HenMapCaCon.dll, written in Go, serves TLS over a named pipe and can pull files.
Impact: Covert remote control of isolated network hosts
| Product | Affected |
|---|---|
| Microsoft Windows | — |
- 1.Limit SMB between network segments and log scheduled-task creation.
- 2.Check TreatAs and W32Time TimeProviders for unexpected DLL providers.
- 3.Hunt unusual system DLLs and the listed modified ChaCha20 constant in memory.
- ATT&CK
- T1021.002 SMB/Windows Admin SharesT1053.005 Scheduled TaskT1574.002 DLL Side-LoadingT1546.015 Component Object Model HijackingT1547.003 Time Providers
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- StingyBasilisk
- Organizations
- Positive Technologies
From the original article
4 min read at cybersecuritynews.com
A new espionage group is using Windows named pipes and the SMB file-sharing protocol to move malware through tightly separated networks. Positive Technologies calls the group StingyBasilisk. It has been active since at least April 2022.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.