PassiveNeuron Targets High-Profile Servers to Deploy Malware
A sophisticated cyberespionage campaign known as PassiveNeuron has been identified by security researchers, revealing its operations and attack methods.
A sophisticated cyberespionage campaign known as PassiveNeuron has been identified by security researchers, revealing its operations and attack methods.
First detected in June 2024, PassiveNeuron targets government, financial, and industrial organizations across Asia, Africa, and Latin America. The campaign primarily exploits Microsoft SQL servers to gain initial access to networks, focusing on Windows Server machines. Attackers leverage vulnerabilities in SQL software or brute-force database administration credentials to execute malicious commands.
Once access is gained, ASPX web shells are deployed to maintain a foothold, although these early-stage attempts are often disrupted by security solutions. The attackers demonstrate adaptability by modifying deployment techniques, switching between encoding methods, and using different scripting languages to evade detection.
The PassiveNeuron campaign utilizes three malicious implants: Neursite, NeuralExecutor, and the Cobalt Strike framework.
A sophisticated cyberespionage campaign known as PassiveNeuron has been identified by security researchers, revealing its operations and attack methods.
Neursite: A custom C++ modular backdoor with a sophisticated configuration system, supporting multiple C2 servers, HTTP proxy, and operational scheduling. Its plugin architecture allows for dynamic capabilities such as shell command execution, file system management, and TCP socket operations. NeuralExecutor: A .NET-based loader protected by the ConfuserEx obfuscator. It executes additional .NET payloads from command-and-control servers using various communication protocols. The latest versions incorporate the Dead Drop Resolver technique, retrieving C2 addresses from GitHub repositories. Both implants are deployed via DLL loaders, utilizing Phantom DLL Hijacking for persistence and incorporating MAC address verification checks to ensure execution on targeted machines.
Attribution is challenging, with some indicators pointing toward Chinese-speaking threat actors. The 2025 NeuralExecutor samples resemble techniques linked to APT31 and APT27 groups, and a malicious DLL path associated with APT41 activities was identified. Early samples contained Russian-language strings, considered potential false flags.
After initial detection in June 2024, PassiveNeuron was dormant for approximately six months before resurfacing in December 2024. The campaign continues to demonstrate persistence, with infections ongoing through August 2025. The targeted nature of attacks suggests intelligence gathering against specific high-value organizations.
Organizations are advised to implement robust SQL injection defenses, monitor server applications vigilantly, and deploy comprehensive web shell detection capabilities to protect against PassiveNeuron and similar threats. Prioritizing server protection, especially for internet-facing machines, is crucial to safeguarding against these advanced persistent threats.
Based on reporting by GBHackers.