Blog
DEEP#DOOR - The Python Backdoor Using Legitimate Tunneling to Siphon Cloud Credentials
The Stealth of DEEP#DOOR
While many attackers still rely on noisy, dedicated command-and-control (C2) servers, DEEP#DOOR takes a more "legitimate" approach. The malware uses bore[.]pub, a Rust-based tunneling service, to establish communication between the compromised host and the attacker.
By utilizing a public TCP tunneling service, the malware eliminates the need for the attacker to maintain suspicious external infrastructure. This makes the traffic look like standard outbound connections, often sailing right past traditional firewalls and intrusion detection systems.
How the Attack Unfolds
The intrusion typically begins with a phishing attempt delivering an obfuscated batch script (install_obf.bat). Once executed, the following chain occurs:
- Security Disablement - The script immediately attempts to disable Windows security controls to fly under the radar.
- Payload Extraction - It dynamically extracts and reconstructs an embedded Python payload named svc.py, which acts as the core implant.
- Persistence - The malware digs in deep using registry Run keys, the Startup folder, scheduled tasks, and even optional WMI subscriptions.
- Data Siphoning - Once active, the "bore" tunnel allows operators to execute commands and harvest an alarming range of data.
The "Cloud-First" Target List
The most concerning aspect of DEEP#DOOR is its focus on high-value identity and infrastructure targets. It isn't just looking for your Netflix password; it is hunting for the keys to your entire enterprise kingdom:
- Cloud Credentials - Specifically targets secrets for AWS, Google Cloud, and Microsoft Azure.
- Browser Secrets - Harvesters credentials stored in Google Chrome and Mozilla Firefox.
- Identity Vaults: Siphons data from the Windows Credential Manager and extracts SSH keys.
- Surveillance - Capabilities include keylogging, clipboard monitoring, screen capture, and even ambient audio/webcam access.
At NOCTeam, we specialize in identifying these "silent" tunneling threats before they become a full-scale breach. From hardening M365 tenants to deep-dive EDR monitoring, we ensure your infrastructure stays boring for the right reasons.
📩 [email protected]
#CyberSecurity2026 #PythonBackdoor #CloudSecurity #IdentityTheft #ITInfrastructure #EDR #DeepDoor #ZeroTrust
Originally published on LinkedIn.