Researchers have observed a previously undisclosed custom multi-stage backdoor dubbed “Stealth Soldier” involved in a wave of highly targeted espionage attacks against North Africa. The Stealth Solider malware strain is known to primarily operate “surveillance functions such as file exfiltration, screen and microphone recording, keystroke logging and stealing browser information.” The first version of Stealth Soldier was first compiled in October 2022 and the most recent version was likely delivered in February 2023. Researchers note that the command-and-control (C2) servers in this ongoing campaign have been observed mimicking sites belonging to the Libyan Ministry of Foreign Affairs. It was also explained that there are indications that the C2 servers are a part of a larger infrastructure set and related to various domains, which have in part been utilized for spear-phishing campaigns against government entities. As of June 8, 2023, this campaign, based on the phishing website themes and submitted samples, is believed to be targeting Libyan organizations. The attack begins with the victims triggering a fraudulent downloader, currently believed to be delivered through social engineering. Six (6) files are downloaded from the C2 server with the main three (3) being “Loader”, “Watchdog”, and “Payload”. A decoy empty PDF is downloaded and opened as well. Researchers emphasized that the malware uses various types of commands during its attack-chain, including plugins that are downloaded from the C2 and modules that are included in the malware already. Stealth Soldier typically uses XOR encryption with two (2) hardcoded strings that are used to masquerade as legitimate strings in order to make detection more difficult. Infrastructure similarities between Stealth Soldier and “Eye of the Nile”, a campaign targeting journalists and human rights activists in Egypt in 2019, were identified by researchers, who emphasized that Stealth Soldier may potentially be the first re-appearance of this threat actor since the 2019 campaign. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.