[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzBO6IJYztQr9pev_uYvmFYrTfpydW9I59beAihfAVDI":3},{"article":4,"iocs":54,"watch_terms":64,"solutions":65,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"ba799646-155b-42e7-8a62-3362a08c45cf","Hackers Use Windows Named Pipes and SMB to Spread Malware Across Isolated Government Networks","hackers-use-windows-named-pipes-and-smb-to-spread-malware-across-isolated-govern-4ab131","A new espionage group is using Windows named pipes and the SMB file-sharing protocol to move malware through tightly separated networks. Positive Technologies calls the group StingyBasilisk. It has been active since at least April 2022. The attackers sat quietly inside the victim’s systems for a long time and posed as the organization’s own security […] The post Hackers Use Windows Named Pipes and SMB to Spread Malware Across Isolated Government Networks appeared first on Cyber Security News.","A new espionage group named StingyBasilisk, active since April 2022, is using Windows named pipes and SMB to spread malware across isolated government networks. The group employs custom agents and DLLs that run in memory, leaving minimal traces on disk. They achieve persistence through COM hijacking and by abusing the Windows Time service.","StingyBasilisk group uses Windows named pipes and SMB to spread malware in isolated government networks.","https:\u002F\u002Fcybersecuritynews.com\u002Fwindows-named-pipes-and-smb\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-Windows-Named-Pipes-and-SMB-to-Spread-Malware-Across-Isolated-Government-Networks.webp","2026-11-13T11:30:35+00:00","2026-11-13T12:00:36.324945+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"StingyBasilisk","threat_actor",{"name":21,"type":22},"Positive Technologies","vendor",{"name":24,"type":25},"Windows Named Pipes","technology",{"name":27,"type":25},"SMB",{"name":29,"type":30},"Impacket","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,61],{"type":43,"value":56,"context":57},"CunningDoor","Loader used by StingyBasilisk",{"type":43,"value":59,"context":60},"SilentCOM","Malware family using COM hijacking for persistence",{"type":43,"value":62,"context":63},"TediousLoader","Malware loader abusing Windows Time service for persistence",[21,29],{"controls":66,"vendors":153},[67,96,124],{"slug":68,"name":69,"problem":70,"products":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":53,"name":97,"problem":98,"products":99},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":125,"name":126,"problem":127,"products":128},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[],{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":164},"espionage-group-abuses-windows-internals-to-pivot-across-air-gapped-government-networks","Espionage Group Abuses Windows Internals to Pivot Across Air-Gapped Government Networks","StingyBasilisk demonstrates that network isolation alone is insufficient when attackers can exploit legitimate Windows protocols — named pipes and SMB — to move laterally between segments. The group's use of COM hijacking and Windows Time service abuse for persistence exploits trusted, built-in mechanisms that many organizations neither restrict nor monitor. Running payloads entirely in memory minimizes forensic artifacts, allowing the campaign to persist since at least April 2022 before detection. This matters because government networks holding sensitive data are high-value targets, and relying on physical or logical separation without hardening internal protocol usage creates a false sense of security.",[159,160,161,162,163],"MITRE ATT&CK T1021.002: Remote Services: SMB\u002FWindows Admin Shares","MITRE ATT&CK T1546.015: Event Triggered Execution: Component Object Model Hijacking","MITRE ATT&CK T1055: Process Injection","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SC-7: Boundary Protection",{"MITRE ATT&CK T1055: Process Injection":165,"NIST SP 800-53 SC-7: Boundary Protection":166,"MITRE ATT&CK T1021.002: Remote Services: SMB\u002FWindows Admin Shares":167,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":168,"MITRE ATT&CK T1546.015: Event Triggered Execution: Component Object Model Hijacking":169},"Running custom agents and DLLs entirely in memory to evade disk-based detection aligns with process injection and in-memory execution techniques designed to avoid forensic artifacts.","This control requires monitoring and controlling communications at network boundaries, which would have restricted SMB-based lateral movement across supposedly isolated government network segments.","StingyBasilisk explicitly uses SMB to spread malware laterally across isolated network segments, which is exactly the technique this entry documents.","Hardening named pipe permissions, COM object registrations, and the Windows Time service — all abused in this attack — falls under the secure configuration baselines this control requires.","The group achieves persistence via COM hijacking, the precise persistence mechanism this technique describes, allowing malware to execute when legitimate COM objects are invoked."]