Security researchers have identified BINDCLOAK, a new modular Windows backdoor linked to an East Asia-connected threat actor targeting government organizations in the Middle East. The malware appears to be a variant of OctLurk, previously observed in attacks against Central Asian targets. It can collect user and process tokens, start modules under stolen privileges, load additional malware directly into memory, and communicate with attacker-controlled command-and-control (C2) servers over TLS.
BINDCLOAK Steals Tokens The malware generates a four-byte identifier for each infected system based on the computer name and the serial number of the C: drive. The plugin loader allocates memory with read, write, and execute permissions, then resolves imports and runs the DLL entry point.
Malware also employs techniques to minimize detection, such as avoiding direct calls to LoadLibraryW from suspicious, unbacked memory. Security tools frequently flag API requests coming from memory regions not linked to a legitimate executable file. It can also gather details on active processes, including process IDs, session IDs, associated usernames, domains, and token permissions.
Indicators of Compromise IOC Type Indicator Description MD5 7a14a99d70d42d3f7bf72f843185fc07 BINDCLOAK DLL sample SHA-1 577b1cc894636f4ac5ad670b0079b9b7ade137c3 BINDCLOAK samp
