Nexe Backdoor: Patchwork APT's Evasive Tactics

Cyble Research and Intelligence Labs observed an active Patchwork APT campaign using malicious LNK files that invoke PowerShell to download a decoy PDF and a malicious DLL, perform DLL sideloading via WerFaultSecure.exe, decrypt and execute shellcode in memory, patch AMSI/ETW APIs to evade detection, and exfiltrate system identifiers to hardcoded C2 domains (e.g., iceandfire.xyz, scapematic.info). The report provides technical analysis, IOCs (hashes, URLs, domain), a YARA rule, MITRE ATT&CK mappings, and recommendations for email filtering, script restrictions, application whitelisting, and network monitoring.