New PassiveNeuron Attacking Servers of High-Profile Organizations to Implant Malware
The PassiveNeuron cyberespionage campaign has re-emerged, targeting government, financial, and industrial organizations in Asia, Africa, and Latin America. Initially detected in 2024, the campaign resumed activity in December 2024, with recent infections…
The PassiveNeuron cyberespionage campaign has re-emerged, targeting government, financial, and industrial organizations in Asia, Africa, and Latin America. Initially detected in 2024, the campaign resumed activity in December 2024, with recent infections noted as of August 2025.
This campaign employs advanced persistent threat implants named Neursite and NeuralExecutor, along with the Cobalt Strike framework, to compromise Windows Server systems. It primarily targets Microsoft SQL servers to gain initial remote command execution, utilizing SQL vulnerabilities, injection flaws, or compromised database credentials. Attackers deploy ASPX web shells for sustained access, although security solutions often block these attempts.
To bypass detection, attackers use Base64 and hexadecimal encoding, switch between PowerShell and VBS scripts, and write payloads line-by-line. Researchers from Securelist have identified a sophisticated multi-stage infection chain involving DLL loaders.
The first-stage loaders are strategically placed in the System32 directory and exploit the Phantom DLL Hijacking technique for automatic persistence. These DLLs are artificially inflated to exceed 100 MB, making them difficult for security solutions to detect.
The PassiveNeuron cyberespionage campaign has re-emerged, targeting government, financial, and industrial organizations in Asia, Africa, and Latin America.
Advanced anti-analysis mechanisms, including MAC address validation, ensure execution only on intended victim machines. The first-stage loader exits immediately if no match is found, preventing execution in sandbox environments.
The PassiveNeuron infection chain follows a four-stage loading process. After the first-stage loader validates the target machine, it loads a second-stage DLL from disk, with file sizes exceeding 60 MB. This loader opens a text file containing Base64-encoded and AES-encrypted data with the third-stage loader. The third-stage payload launches a fourth-stage shellcode loader within legitimate processes like WmiPrvSE.exe or msiexec.exe.
The Neursite backdoor, as the final-stage implant, features modular capabilities for system reconnaissance, process management, lateral movement, and file operations. Attribution analysis suggests the involvement of Chinese-speaking threat actors, with techniques associated with APT31, APT27, and potentially APT41 groups.
Based on reporting by Cyber Security News.