Twice around the dance floor - Elastic discovers the PIPEDANCE backdoor

Elastic Security Labs describes and analyzes PIPEDANCE, a previously undocumented Windows backdoor that uses hardcoded named pipes and RC4 to enable stealthy lateral movement, interactive shells, file/process discovery, multiple process-injection techniques (including Heaven’s Gate and thread hijacking), and network connectivity checks; the report includes command mappings, observed use to deploy Cobalt Strike in a Vietnamese environment, detection guidance (YARA, KQL), and IOCs such as SHA-256 hashes and a C2 URL.