The Intel “AppDomain” Hijack: Unmasking a Sophisticated Post-Exploitation Framework

CYFIRMA reports a sophisticated multi-stage post-exploitation framework targeting financial organizations in the Middle East and EMEA that hijacks the .NET AppDomain Manager to weaponize a signed Intel utility (IAStorHelp.exe), enabling stealthy in-memory execution via JIT-based trampolining, extensive obfuscation, sandbox-evasion delays, and CloudFront domain-fronted C2, representing a high-risk, resilient toolset comparable to mature offensive platforms.