PoldatMalware
- kabob
- Zlib
ZLib is a full-featured backdoor that was used as a second-stage implant during Operation Dust Storm since at least 2014. ZLib is malware and should not be confused with the legitimate compression library from which its name is derived.From MITRE ATT&CK
Last reported 3 months ago, by Sekoia.io5 reports
ATT&CK techniques
6 of 44 · each with the sentence it comes from- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
- T1567Exfiltration Over Web Service
“Exfiltration Over Web Service”
- T1027Obfuscated Files or Information
“T1027”
- T1027.007Dynamic API Resolution
“Linux/macOS implementation is almost identical: the dynamic API resolution part does not apply to POSIX systems but overall mechanisms are the same.”
- T1027.009Embedded Payloads
“Once validated, the malware decrypts five embedded payloads and achieves persistence by dropping a trojanised _disutils_hack package and malicious .pth files into the Python site-packages directory, subsequently timestomping the files to evade forensic detection.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Don't Eat the ChocoPoCs: Trojanised PoCs Hit Researchers“The payloads are stored obfuscated and compressed using the Zlib algorithm.”
-
Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware“Decompressing with Zlib yields a string table, as shown in Figure 13.”
-
NANOREMOTE, cousin of FINALDRAFT“These requests occur over HTTP where the JSON data is submitted through POST requests that are Zlib compressed and encrypted with AES-CBC using a 16-byte key (558bec83ec40535657833d7440001c00).”
-
You've Got Malware: FINALDRAFT Hides in Your Drafts“Content for message requests and responses are Zlib compressed, AES CBC encrypted, and Base64 encoded.”
-
Collecting Cobalt Strike Beacons with the Elastic Stack“Using the CyberChef web application, add the “From Base64” and “Zlib Inflate” recipesand then paste the contents of the process.Ext.memory_region.bytes_compressed field into the ).”
Indicators in its reports
named in the reports above- hxxp://ip-api[.]com/jsonin 1 report
- hxxps://github[.]com/ogenich/CVE-2026-48908in 1 report
- hxxps://api.mapbox[.]com/datasets/v1/frankley/cmor0tcxf008i1mmpd7apt903/features/dm370543acmdopk296nahbtuain 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.