Rover Backdoor

The Rover Backdoor is a type of malware, a harmful software designed to exploit and damage computer systems. This malicious software infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. The Rover Backdoor has been utilized in various forms by different cyber threat actors over time. Earlier versions of the Rover Backdoor were analyzed in our report, revealing that they were used by two notable threat groups: SideWinder and Confucius. These groups leveraged the malware's capabilities to carry out their nefarious activities, demonstrating the potency and adaptability of the Rover Backdoor. The analysis provides key insights into how these groups operated and how the malware evolved over time. A recent report by cybersecurity firm Kaspersky has identified a new group, Mysterious Elephant, which exhibits a combination of new backdoor families and distinct tactics, techniques and procedures (TTPs). What sets Mysterious Elephant apart from other groups is also what ties them to Confucius and SideWinder - the use of the Rover Backdoor. This suggests a shared lineage or learning among these threat actors, further emphasizing the ongoing relevance and threat posed by the Rover Backdoor malware.