Hackers Use Windows Named Pipes and SMB to Spread Malware Across Isolated Government Networks
StingyBasilisk group uses Windows named pipes and SMB to spread malware in isolated government networks.
A new espionage group named StingyBasilisk, active since April 2022, is using Windows named pipes and SMB to spread malware across isolated government networks. The group employs custom agents and DLLs that run in memory, leaving minimal traces on disk. They achieve persistence through COM hijacking and by abusing the Windows Time service.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Positive Technologies?
Get an email when a new story names Positive Technologies, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonStingyBasilisk demonstrates that network isolation alone is insufficient when attackers can exploit legitimate Windows protocols — named pipes and SMB — to move laterally between segments. The group's use of COM hijacking and Windows Time service abuse for persistence exploits trusted, built-in mechanisms that many organizations neither restrict nor monitor. Running payloads entirely in memory minimizes forensic artifacts, allowing the campaign to persist since at least April 2022 before detection. This matters because government networks holding sensitive data are high-value targets, and relying on physical or logical separation without hardening internal protocol usage creates a false sense of security.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — CunningDoor
- malware — SilentCOM
- malware — TediousLoader