New TorNet backdoor seen in widespread campaign

Cisco Talos identified a financially motivated phishing campaign (since July 2024) targeting mainly Polish and German users that delivers multiple Windows malware families — including an AES-encrypted PureCrypter loader and a new .NET backdoor called TorNet — via .tgz email attachments; the actors use reflective loading, anti-analysis and anti-VM checks, disable/re-enable the network (ipconfig /release and /renew) to evade cloud AV, establish persistence via Run keys and scheduled tasks that run even on low battery, route backdoor C2 traffic through the Tor network, and support execution of arbitrary .NET assemblies from C2; the report includes IOCs, Snort SIDs, and ClamAV detections.