Deadglyph

Deadglyph is a sophisticated malware, named and detailed by ESET, used in cyberespionage attacks targeted at Middle Eastern governments. The malware is linked to the Stealth Falcon Advanced Persistent Threat (APT) group, also known as FruityArmor, which has been previously associated with the United Arab Emirates (UAE). Deadglyph consists of a native x64 binary that functions as an executor and a .NET assembly that functions as an orchestrator, presenting a unique architecture that separates it from traditional backdoor malware. The discovery and analysis of Deadglyph were made public on September 25, 2023, revealing its deployment in cyberespionage attacks against a government entity in the Middle East. Unlike typical backdoor malware, Deadglyph does not receive commands from the backdoor binary. Instead, it receives its functions dynamically from a command-and-control (C2) server in the form of modules, enhancing its stealth and adaptability. This novel approach to command and control makes the malware particularly difficult to detect and neutralize. During the investigation of Deadglyph, ESET discovered a Control Panel (CPL) file signed with an expired certificate that was uploaded to VirusTotal from Qatar. This file functioned as a multistage shellcode downloader and shared code similarities with Stealth Falcon’s backdoor, further linking the malware to this APT group. The emergence of Deadglyph underscores the escalating sophistication of cyber threats and the ongoing need for robust cybersecurity measures, particularly within sensitive sectors such as government agencies.