Threat Intel
BLOODALCHEMY Backdoor Exploits Brother BrDifxapi DLL Side-Loading
A new x86 backdoor, BLOODALCHEMY, injects shellcode into the signed Brother BrDifxapi.exe utility via a side‑loaded unsigned DLL named BrLogAPI.dll. The payload is not reflexive and requires a specific loader, making it vulnerable to DLL side‑loading attacks. Defenders should audit Brother binaries, enforce DLL signing, and monitor for unauthorized DLL injection.
What Happened
Adversaries deployed the legitimate Brother Industries utility BrDifxapi.exe, which has a revoked signature and is vulnerable to DLL side‑loading. They sideloaded an unsigned DLL named BrLogAPI.dll that contains the BLOODALCHEMY loader and injected shellcode into the process. The loader then executes the backdoor shellcode, which is not position‑independent and requires patching if loaded at a different base address.
Impact
The backdoor can establish persistence, communicate with a command‑and‑control server, and run in multiple modes. It is part of the REF5961 intrusion set and is still under active development, indicating potential for future enhancements.
What to Do
- Verify the integrity of Brother BrDifxapi.exe and ensure it is signed with a valid, non‑revoked certificate.
- Block or monitor the loading of unsigned DLLs with the name BrLogAPI.dll in any process.
- Implement DLL integrity checks and enforce code‑signing policies on all critical binaries.
- Use endpoint detection to detect shellcode injection and anomalous process memory modifications.
- Apply the latest patches for Brother utilities and disable unused services that may allow side‑loading.
Technical Details
Strings in BLOODALCHEMY are stored in an encrypted blob, each prefixed with a single‑byte key. The decryption routine extracts the key, decrypts the string, and uses it for configuration and communication.
Related vulnerabilities
Chinese Espionage Group Deploys New SparroWocky Backdoor in Latin America
FamousSparrow, a China‑linked threat actor, has moved beyond its old SparrowDoor tool and rolled out the modular C++ backdoor SparroWocky against government entities across Latin America. The malware uses sophisticated anti‑analysis tricks—DLL side‑loading, RC4‑encoded payloads, dynamic API resolution, and CreateThread hooking—to evade detection. It can execute commands, exfiltrate data, capture high‑frequency screenshots, proxy traffic, and even wipe its own traces. ESET’s analysis pinpoints 18 C2 endpoints and shows the operation has been active for over a year, targeting Argentina, Ecuador,
Read briefing
ValleyRAT Backdoor Distributed via Signed Adware and DLL Sideloading
Threat actors are distributing the ValleyRAT backdoor disguised as a signed adware application called QN Wallpaper. The campaign uses DLL sideloading to execute malicious payloads while distracting users by installing legitimate software like Google Chrome or DingTalk. SecOps and system administrators should audit autorun entries, monitor unexpected DLL loading, and inspect endpoint exclusions.
Read briefing
BambooToken Malware Exploits MQTT to Command Windows and Linux Systems
A stealthy, previously unknown malware family called BambooToken has been active since 2023 and now leverages the MQTT protocol for command‑and‑control. The framework infects Windows and Linux hosts via side‑loading signed USB‑token software or by masquerading as the Kingsoft Office suite, then subscribes to broker topics to receive instructions. Researchers uncovered dead code hinting at keylogging, clipboard theft, and media capture, while the latest Linux variant (v2.1) can spawn shells and move files. Roughly a dozen enterprises—mostly in Asia and South America—were hit, with mobile‑app ba
Read briefing
FINALDRAFT Malware Uses Microsoft Graph API for C2 in Espionage Campaign
Elastic Security Labs uncovered a new espionage malware family, FINALDRAFT, that leverages Outlook and Microsoft Graph API for command and control. The kit includes a lightweight Windows loader, PATHLOADER, and a Linux variant, using typosquatted domains and API hashing to evade analysis. Defenders should block the identified domains, monitor Graph API traffic, and detect PATHLOADER execution.
Read briefing