Deadglyph

Deadglyph is a sophisticated malware, or malicious software, discovered in September 2023 by ESET researchers. It was identified as a new backdoor used by the FruityArmor threat actor, also known as Stealth Falcon, primarily targeting Middle Eastern governments. The malware consists of a native x64 binary that functions as an executor and a .NET assembly that serves as an orchestrator. Its unique architecture allows it to receive functions dynamically from a command-and-control (C2) server in the form of modules, instead of relying on traditional backdoor commands from the binary. In conjunction with Deadglyph, the ShadowWhisperer and NightmareLoader tools were outlined in an Advanced Persistent Threat (APT) report released the same month. These tools are suspected to be part of the downloader chain leveraged in the installation process of Deadglyph. Furthermore, a related shellcode downloader was discovered, which researchers postulate could potentially be used for installing the malware. Recently, an updated version of the native DeadGlyph Executor backdoor module has been identified, featuring changes to both its architecture and workflow components. This novel backdoor has been deployed in cyber-espionage attacks against government entities in the Middle East, marking a significant escalation in the capabilities of the FruityArmor threat actor. The continuous evolution of this malware underscores the necessity for rigorous cybersecurity measures, especially for high-risk targets such as government agencies.