SQUIDOOR: SUSPECTED CHINESE THREAT ACTOR'S BACKDOOR TARGETS GLOBAL ORGANIZATIONS

Summary from the TLDR InfoSec newsletter

In this post, PAN's Unit42 analyzes a sophisticated backdoor named Squidoor targeting Windows and Linux systems. The suspected Chinese threat actors exploited vulnerabilities in IIS servers to deploy web shells for persistent access and lateral movement. Squidoor allows attackers to maintain access, execute commands, and communicate stealthily with their operators across different networks using the Outlook API or tunnels over ICMP or DNS.