HDoor

Executive Summary

HDoor is a Windows backdoor used by the Naikon group to maintain persistence, exfiltrate data, and facilitate lateral movement within corporate environments. The malware establishes encrypted C&C channels, employs registry or scheduled task persistence, and can harvest credentials from local stores. It poses significant risk for long‑term espionage, especially against organizations with complex Windows infrastructures.

HDoor, sometimes referred to as Custom HDoor, is a Windows-based backdoor that has been tailored and employed by the Naikon threat group since at least 2015. The malware was first identified in a report by Baumgartner on Naikon, illustrating its use as part of the group's persistent espionage toolkit. In operation, HDoor establishes a covert command‑and‑control channel with the adversary’s servers, often over encrypted HTTP or HTTPS traffic to blend with legitimate web traffic. Once executed it typically creates persistence mechanisms such as registry Run keys and scheduled tasks, enabling automatic reloading upon system boot or user logon. Beyond remote execution, the worm can exfiltrate files, capture screenshots, and harvest credentials from local credential stores. It also supports lateral movement through standard Windows credentials, leveraging native system tools like WMI and PowerShell to spawn new sessions on compromised hosts. The code is obfuscated, making static analysis difficult, while runtime behavior includes attempts to detect sandbox or debugging environments. The impact of HDoor lies largely in its support for a broad range of espionage activities—remote control, data theft, and persistence—thereby providing adversaries with persistent footholds that can be leveraged for long-term reconnaissance and lateral infiltration across enterprise networks.

Key Capabilities

• Remote command execution via encrypted HTTP/HTTPS C2
• Persistent installation through registry Run keys and scheduled tasks
• Credential harvesting from local credential caches
• File exfiltration and screenshot capture
• Process injection to conceal activity and leverage native tools
• Lateral movement using WMI, PowerShell, and stolen credentials

ATT&CK Techniques

Recommended Actions

• Block outbound traffic on commonly used C&C ports and domains associated with HDoor via DPI or firewall rules
• Deploy endpoint detection engines that look for the known persistence registry keys and scheduled task patterns
• Implement application whitelisting to prevent execution of unknown binaries matching HDoor hash signatures
• Run regular file integrity monitoring (FIM) to detect new or modified executables in critical system directories
• Educate users about phishing and suspicious email attachments that could deliver HDoor
• Conduct thorough network traffic analysis for unusual encrypted outbound connections, especially with low entropy payloads

Suggested Tags