Islamic Nonprofit Infiltrated for 3 Years With Silent Backdoor

Cisco Talos researchers uncovered a stealthy, long-running espionage campaign (active since March 2021) targeting a Saudi Arabian charity using a custom backdoor named Zardoor. The attackers established persistent C2 via modified open-source reverse-proxy tools (FRP, Socks custom server, Venom), used WMI for lateral movement, and exfiltrated encrypted data approximately twice monthly; Cisco published detections and IOCs to help defenders hunt and remediate infections.