New ShroudedSnooper actor targets telecommunications firms in the Middle East with Novel Implants

• Cisco Talos recently discovered a new malware family we’re calling “HTTPSnoop” being deployed against telecommunications providers in the Middle East.


• HTTPSnoop is a simple, yet effective, backdoor that consists of novel techniques to interface with Windows HTTP kernel drivers and devices to listen to incoming requests for specific HTTP(S) URLs and execute that content on the infected endpoint.


• We also discovered a sister implant to “HTTPSnoop” we’re naming “PipeSnoop,” which can accept arbitrary shellcode from a named pipe and execute …

actor backdoor calling cisco cisco talos devices drivers family http implants interface kernel kernel drivers malware middle east novel requests simple talos techniques telecommunications windows