BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

Elastic Security Labs describes BITSLOTH, a previously undocumented Windows backdoor used in an intrusion (REF8747) against a South American foreign ministry; the malware abuses the Background Intelligent Transfer Service (BITS) for stealthy C2 and persistence, implements 35 command handlers (discovery, execution, file upload/download, keylogging, screenshots), includes observable IOCs (file hashes, C2 IPs, BITS job names), and shows development history dating back to 2021.