StingyBasilisk uses named pipes, COM hijacking, and time providers
Original title: StingyBasilisk APT Uses Windows Named Pipes to Control Malware and Evade Security Detection
The espionage group has been in a victim network since at least April 2022; the initial access vector is unknown.
Positive Technologies’ PT ESC IR team says a previously unknown espionage group, StingyBasilisk, has operated inside a victim network since at least April 2022. From February 2026 the operators moved over SMB, launched payloads with Impacket’s atexec, and persisted through COM hijacking and Windows Time providers. Implants including CunningDoor, SilentCOM, and TediousLoader communicate over named pipes and execute encrypted payloads in memory.
Unconfirmed: The initial infection vector is unknown, and the activity is not reliably tied to a known APT group.
- CunningDoor first ran on 12 February 2026 through rundll32 and IKEYUI64.dll.
- Scheduled-task names used a GUID-style pattern instead of Impacket’s default names.
- TediousLoader reads the first 256 bytes of packets and looks for an 8-byte signature.
- A modified ChaCha20 constant is described as a memory-scanning indicator.
- HenMapCaCon.dll hosts a TLS server on the pipe \\.\PIPE\ProProBitOpen.
Impact: In-memory remote control and file theft over named pipes
| Product | Affected |
|---|---|
| Microsoft Windows | — |
- 1.Monitor TreatAs changes under HKLM CLSID keys.
- 2.Audit new W32Time TimeProviders entries for unexpected DLLs.
- 3.Alert on rundll32 launching signed vendor DLLs from Temp.
- ATT&CK
- T1546.015 Component Object Model HijackingT1547.003 Time ProvidersT1021.002 SMB/Windows Admin SharesT1053.005 Scheduled TaskT1574.002 DLL Side-Loading
- Vendors
- Microsoft
- Products
- Windows
- Threat actors
- StingyBasilisk
- Organizations
- Positive Technologies
From the original article
3 min read at gbhackers.com
A previously unknown espionage-focused group, tracked as StingyBasilisk, has run covert operations against a victim network since at least April 2022. The initial infection vector remains unknown, and the activity cannot yet be reliably tied to any known APT group. From February 2026, the attackers moved across the network over SMB.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.