Stealthy Deep#Door Stealer Targets Windows Machines, Credentials

A sophisticated new Python-based backdoor framework known as Deep#Door stealer is being used in intrusions targeting Windows machines, using an obfuscated deployment chain, extensive defense evasion, and fileless-style techniques for long-term persistence and theft of sensitive data such as credentials, SSH keys, and loud tokens.

The Intrusion Chain: Embedded, Stealthy Delivery

The attack chain starts with the execution of a heavily obfuscated batch script, install_obf.bat, which serves as the primary dropper. Unlike most malware, Deep#Door is self-contained: The dropper uses a self-referential parsing technique to read its own contents and dynamically extract the main Python payload, svc.py, from its body. According to an analysis of the malware by researchers at Securonix, this embedded payload delivery minimizes network detection opportunities and reduces disk artifacts. The script then writes the payload to %LOCALAPPDATA%\SystemServices\svc.py, a directory intentionally named to mimic legitimate Windows services.

“This approach eliminates the need for secondary payload downloads and mimics fileless execution behavior, making detection through network telemetry significantly more difficult,” the analysis says.

To maintain persistence, Deep#Door establishes multi-layered persistence by deploying a VBScript launcher (SystemServices.vbs) in the victim’s Startup folder, creating Registry Run key entries, and potentially setting up Scheduled Tasks and WMI event subscriptions. A continuous watchdog thread also monitors these artifacts, automatically restoring any missing persistence components if they are removed.

Covert Command-and-Control 

Deep#Door employs a highly stealthy C2strategy by leveraging bore[.]pub, a public TCP tunneling service. This approach enables external operators to reach internal, compromised systems without exposing traditional C2 infrastructure, blending malicious traffic with legitimate tunneling usage.

C2 initialization involves:

• Dynamic Port Scanning: The malware scans a large port range (e.g., 41234-41243) using up to 100 concurrent worker threads to quickly locate an active tunnel, avoiding static indicators.
• Challenge-Response Authentication: Authentication happens through a custom handshake where the client responds to a server-sent challenge string with SHA256(challenge + password), preventing unauthorized connections and keeping the password from being sent in cleartext.

Aggressive Defense Evasion and Anti-Analysis

Before and during execution, the malware systematically weakens host-based security controls to ensure minimal visibility. The loader uses PowerShell commands to suppress core Windows Defender features, including Real-Time Monitoring, Behavior Monitoring, Block-at-First-Seen, and IOAV Protection, while also adding directory and process exclusions for python.exe and the SystemServices folder. It also disables SmartScreen, PowerShell logging (Script Block and Transcription), and Windows Firewall logging to obstruct forensic reconstruction.

Once on a target machine, the Python implant extends its protections through in-memory manipulation:

• API Patching: It patches AMSI functions to bypass script scanning and neutralizes ETW (Event Tracing for Windows) logging by patching core telemetry APIs.
• Forensic Resistance: The malware attempts to restore a clean copy of ntdll.dll, overwrites command-line arguments in memory, and stops/clears Event Logs and Sysmon.
• Anti-Analysis: It performs extensive environmental validation, checking for debuggers (via IsDebuggerPresent and NtQueryInformationProcess), virtual machine indicators, and sandbox environments. If suspicious indicators are found, execution is delayed or stopped.

Espionage and Post-Exploitation Capabilities

The Deep#Door implant acts as a modular RAT, and is equipped with a number of capabilities for espionage and lateral movement.

• Surveillance: Full monitoring capabilities, including keylogging, clipboard monitoring, screen capture, webcam access, and microphone recording.
• Credential Harvesting: Systematically targets stored data, including browser credentials (Chrome, Edge), Windows Credential Manager, Cloud tokens (AWS, Azure, GCP), SSH keys, and Wi-Fi credentials.
• Remote Control: Provides full administration via arbitrary shell command execution, reverse shell functionality, and port scanning.
• Destructive Capabilities: The implant contains advanced features to overwrite the Master Boot Record, trigger a BSOD, or execute a fork bomb.

The Deep#Door implant specifically targets Windows machines and has all of the hallmarks of a professionally developed piece of malware. Securonix did not attribute the backdoor to any specific threat groups, however. 

"We do not have enough evidence to make a high-confidence attribution at this time. The tradecraft appears focused on stealthy persistence and C2 visibility reduction, but we are not tying DEEP#DOOR to a named threat actor without additional corroborating infrastructure, victimology, or operational overlap," said Akshay Gaikwad, senior security research engineer at Securonix.