A newly uncovered Windows backdoor is giving an East Asia-linked espionage operation a quiet way to deepen control inside targeted networks.

Named BINDCLOAK, the modular implant is deployed after initial access and can run malware using more powerful user or process accounts.

The campaign targeted government entities in the Middle East, with a particular focus on the energy sector.

Attackers used a multi-stage chain that began with an ISO file and legitimate-looking Windows components before delivering TELESHIM, MIXEDKEY, and finally BINDCLOAK.

A related report on Telegram bot backdoor controllers explains how the earlier TELESHIM component helped operators manage compromised systems.

Analysts at Zscaler identified BINDCLOAK as a previously undocumented 64-bit Windows backdoor written in C.

Zscaler said in a report shared with Cyber Security News (CSN) that the malware was decrypted and reflectively loaded by MIXEDKEY during post-compromise activity.

The discovery shows how attackers can turn stolen Windows access tokens into a practical privilege escalation tool.

Instead of relying only on a software flaw, BINDCLOAK collects available tokens and uses them to launch its modules with the rights of a more privileged account.

BINDCLOAK Steals Windows User and Process Tokens

BINDCLOAK has commands to collect user tokens, inspect running processes, and identify tokens that can be copied or assigned to new processes.

It can attempt to log in with supplied credentials, retain a successful user token, and later use that token to start a selected module.

The backdoor also examines active processes for their IDs, account details, and token permissions.

That allows the operator to select a process token that may offer stronger access, then duplicate it and start a BINDCLOAK module in that security context.

This approach is especially dangerous because access-token abuse can blend into normal Windows behavior.

Recent Windows privilege escalation research has also shown how gaining SYSTEM-level access can give an attacker broad control of an affected machine.

Once a module receives a higher-privileged token, BINDCLOAK calls the Windows ImpersonateLoggedOnUser function so its activity runs under that account.

The malware can also stop, remove, and replace modules, helping operators adjust their tools without reinstalling the full backdoor.

Modular Backdoor Evades Detection

BINDCLOAK communicates with its command server through TLS over TCP, using a custom message-routing system.

Its messages are compressed, encrypted twice with rolling XOR keys, padded with random data, and then delivered to the relevant internal module.

The malware collects a wide range of host information for its first beacon, including the operating-system version, computer name, username, hostname, local IP address, and local time.

This gives attackers a quick view of each infected system before they decide which commands or plugins to deploy.

Its plugin loader creates memory with read, write, and execute permissions, then loads additional DLL modules directly into memory.

To avoid alerts, it uses RtlQueueWorkItem to invoke LoadLibraryW, a technique intended to make suspicious loading behavior less obvious to endpoint security tools.

Similar concerns apply when attackers abuse legitimate processes for malicious DLL payload injection, which can hide code behind trusted Windows activity.

Researchers assessed with high confidence that BINDCLOAK is a variant of the OctLurk backdoor, citing code similarities and overlapping command-and-control infrastructure.

The same operator appears to have expanded from Central Asia into Middle Eastern targets, underscoring the need to review abnormal token use, unexpected DLL loading, and suspicious outbound TLS connections.

Security teams should investigate unknown ISO files, unusual scheduled tasks, DLLs placed beside trusted executables, and processes launching under unexpected user contexts.

Monitoring anomalous process-token access and reviewing suspicious web-server activity can also support broader cross-platform intrusion investigations.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
MD5 hash	`7a14a99d70d42d3f7bf72f843185fc07`	BINDCLOAK DLL sample
SHA-1 hash	`577b1cc894636f4ac5ad670b0079b9b7ade137c3`	BINDCLOAK sample
SHA-256 hash	`3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d`	BINDCLOAK sample
C2 domain	`cert.hypersnet.com`	BINDCLOAK command-and-control domain
C2 domain	`about.blsouqs.com`	OctLurk command-and-control domain sharing an SSL certificate
C2 domain	`ssl.blsouqs.com`	OctLurk infrastructure contacted during post-compromise activity
Domain	`contacts.ftabnews.com`	Domain contacted during post-compromise activity
Domain	`ftabnews.com`	Infrastructure assessed as potentially used for command and control
IP address	`107.175.172.40`	Common Name in SSL certificate associated with `cert.hypersnet.com`
SSL certificate serial	`59fe1ef7707fe497d89f34505222862f`	Certificate reused across BINDCLOAK and OctLurk infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN

The post BINDCLOAK Steals Windows User and Process Tokens to Run Malware With Higher Privileges appeared first on Cyber Security News.