[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fP2h7p9jDstscxqpAZDaUebtdWfpMSj5tyHt0ssUTveA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"3dbabe6e-f900-4949-80a4-4151b1609434","espionage-group-abuses-windows-internals-to-pivot-across-air-gapped-government-networks","ba799646-155b-42e7-8a62-3362a08c45cf","Espionage Group Abuses Windows Internals to Pivot Across Air-Gapped Government Networks","StingyBasilisk demonstrates that network isolation alone is insufficient when attackers can exploit legitimate Windows protocols — named pipes and SMB — to move laterally between segments. The group's use of COM hijacking and Windows Time service abuse for persistence exploits trusted, built-in mechanisms that many organizations neither restrict nor monitor. Running payloads entirely in memory minimizes forensic artifacts, allowing the campaign to persist since at least April 2022 before detection. This matters because government networks holding sensitive data are high-value targets, and relying on physical or logical separation without hardening internal protocol usage creates a false sense of security.","**Immediate actions:**\n- Audit and restrict SMB and named pipe access between network segments using host-based firewall rules and Group Policy.\n- Review COM object registrations on critical systems and alert on unauthorized or unexpected COM hijacking attempts.\n- Enable memory-based threat detection (e.g., EDR solutions with in-memory scanning) to catch fileless malware that leaves minimal disk artifacts.\n\n**Long-term improvements:**\n- Harden the Windows Time service and other commonly abused Windows services by applying least-privilege configurations and monitoring for unauthorized modifications.\n- Implement micro-segmentation so that even within isolated networks, lateral movement via SMB requires explicit authorization.\n- Establish a formal hardening baseline for all government endpoints that explicitly addresses named pipe permissions, COM object integrity, and Windows service configurations.\n\n**Detection measures:**\n- Deploy behavioral monitoring for anomalous SMB traffic patterns and named pipe creation events across internal segments.\n- Log and alert on modifications to Windows service configurations, particularly the Windows Time service, as an indicator of persistence activity.\n- Correlate memory-only process executions with unusual network connections to identify in-memory implant activity early.",[12,13,14,15,16],"MITRE ATT&CK T1021.002: Remote Services: SMB\u002FWindows Admin Shares","MITRE ATT&CK T1546.015: Event Triggered Execution: Component Object Model Hijacking","MITRE ATT&CK T1055: Process Injection","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SC-7: Boundary Protection",{"MITRE ATT&CK T1055: Process Injection":18,"NIST SP 800-53 SC-7: Boundary Protection":19,"MITRE ATT&CK T1021.002: Remote Services: SMB\u002FWindows Admin Shares":20,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":21,"MITRE ATT&CK T1546.015: Event Triggered Execution: Component Object Model Hijacking":22},"Running custom agents and DLLs entirely in memory to evade disk-based detection aligns with process injection and in-memory execution techniques designed to avoid forensic artifacts.","This control requires monitoring and controlling communications at network boundaries, which would have restricted SMB-based lateral movement across supposedly isolated government network segments.","StingyBasilisk explicitly uses SMB to spread malware laterally across isolated network segments, which is exactly the technique this entry documents.","Hardening named pipe permissions, COM object registrations, and the Windows Time service — all abused in this attack — falls under the secure configuration baselines this control requires.","The group achieves persistence via COM hijacking, the precise persistence mechanism this technique describes, allowing malware to execute when legitimate COM objects are invoked.","published","2026-11-13T12:21:03.13259+00:00","2026-11-13T12:21:03.116+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fwindows-named-pipes-and-smb\u002F","hackers-use-windows-named-pipes-and-smb-to-spread-malware-across-isolated-govern-4ab131","Hackers Use Windows Named Pipes and SMB to Spread Malware Across Isolated Government Networks",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[45,49,53],{"slug":46,"name":47,"problem":48},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":40,"name":54,"problem":55},"Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]