NAPLISTENER: more bad dreams from developers of SIESTAGRAPH

### Executive summary Elastic Security Labs analyzed NAPLISTENER, a C# HTTP-listener backdoor deployed as Wmdtc.exe that masquerades as Msdtc.exe to persist as a Windows service. The implant accepts base64-encoded .NET assemblies via a web path (/ews/MsExgHealthCheckd/) and executes them in memory, intentionally bypassing IIS logs and network-based detection; the report includes analysis of behavior, setup prerequisites (SSL cert binding), a YARA detection rule, and links to similar public code that likely influenced the implant.