Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

StingyBasilisk used named pipes and SMB inside a long-held network

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Positive Technologies says previously unknown StingyBasilisk has controlled a victim network since April 2022; initial access remains unknown.

Positive Technologies’ PT ESC IR team says previously unknown espionage group StingyBasilisk has operated in a victim network since at least April 2022 and posed as the victim’s security tools. From February 2026 it copied malware over SMB into C:\Windows\Temp, started payloads with Impacket atexec, and persisted via COM hijacking, a Windows Time provider, and SafeNet DLL side-loading. Named-pipe implants CunningDoor, SilentCOM, and TediousLoader execute encrypted code in memory so isolated hosts can be controlled. Researchers did not find initial access and did not reliably link a known group. Cyber Security News describes isolated government networks; GBHackers describes one victim network. On TediousLoader encryption, GBHackers cites a modified ChaCha20 constant, while Cyber Security News reports AES-256.

Key facts
  • CunningDoor first ran on 12 February 2026 via rundll32 and IKEYUI64.dll.
  • Scheduled tasks used GUID-style names rather than Impacket’s defaults.
  • SilentCOM hijacks Network List Manager and Network Configuration TreatAs keys.
  • CunningDoor side-loads through signed SafeNet libraries started with rundll32.
  • HenMapCaCon.dll, written in Go, serves TLS on \\.\PIPE\ProProBitOpen and can pull files.
  • TediousLoader inspects packet signatures before running decrypted code in memory.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Feb 12, 2026CunningDoor first ran via rundll32 and IKEYUI64.dll · GBHackers

What each outlet adds

beyond the shared facts
  • GBHackersFirst-run date, ChaCha20 memory indicator, pipe name, and 256-byte signature check.
  • Cyber Security NewsIsolated government segments, AES-256, SafeNet side-loading, and no reliable attribution.
Vendors
Microsoft
Products
Windows
Threat actors
StingyBasilisk
Malware
CunningDoorSilentCOMTediousLoaderHenMapCaCon
Organizations
Positive Technologies

Coverage

oldest first · one row per article · UTC
  1. · 1d ago GBHackersFirst report

    StingyBasilisk uses named pipes, COM hijacking, and time providers

    The espionage group has been in a victim network since at least April 2022; the initial access vector is unknown.

  2. · 1d ago Cyber Security News

    StingyBasilisk moves malware over SMB and named pipes

    Custom in-memory DLL agents relay commands so hosts without Internet can still be controlled.