Taidoor

Taidoor is a Windows backdoor associated with long-running targeted intrusion activity, particularly espionage-oriented campaigns affecting organizations in the Asia-Pacific region.

Taidoor

Family profile

Taidoor is a Windows backdoor associated with long-running targeted intrusion activity, particularly espionage-oriented campaigns affecting organizations in the Asia-Pacific region. It has been active since at least 2009 and has been linked to spearphishing operations in which victims are induced to open malicious document attachments. Observed delivery methods include seemingly benign documents and malicious Microsoft Office files exploiting vulnerabilities such as CVE-2012-0158, as well as earlier exploit-document chains associated with Office RTF exploitation.

Once executed, Taidoor provides remote access and host control capabilities typical of an espionage backdoor. Documented functionality includes process discovery, collection of local system time, and collection of network adapter information including MAC address data. It can query and modify the Windows Registry, including use of autorun locations for persistence, and has been observed establishing persistence through a current-user Run key. It also supports file deletion and file upload from compromised hosts, enabling both cleanup and data theft operations.

Taidoor uses native Windows APIs extensively for execution and runtime behavior, including dynamic loading of libraries and API resolution. It can perform DLL loading and has been observed using encrypted or obfuscated strings internally. For command-and-control communications, Taidoor has used HTTP with RC4-encrypted message bodies. The malware has been classified by vendors as a trojan or backdoor, but the directly supported behavior most strongly characterizes it as a backdoor used in targeted attacks against Windows systems.

Capabilities

Defense Evasion
Exfiltration
Persistence
Reconnaissance

Samples

Recent samples

3 sandbox samples in the Derp library, newest 3 shown

7b9173083c9cd5471568babccccbb21a5edb05121de1725058822193f07d516c

Analysed Oct 6, 2026Triage report

2143ee6399df6f622ed79e922e63668369ed68803b270a0b8a4b60153af2a084

Analysed Oct 6, 2026Triage report

08a46b6ada43cc7e896261d154eb76d928a686bd14051beda1d1e9fb47fc8aea

Analysed Oct 6, 2026Triage report

Exploited software

Vulnerabilities linked to Taidoor

3 CVEs

CVE-2012-0158 MSCOMCTL.OCX RCE Vulnerability CVE-2010-3333 RTF Stack Buffer Overflow Vulnerability CVE-2014-1761 Microsoft Word RTF Memory Corruption Remote Code Execution

MITRE ATT&CK

Taidoor in ATT&CK

28 distinct techniques

Techniques

28 techniques

T1204.002 Malicious File T1071.001 Web Protocols T1566.001 Spearphishing Attachment T1547.001 Registry Run Keys / Startup Folder T1124 System Time Discovery T1095 Non-Application Layer Protocol T1140 Deobfuscate/Decode Files or Information T1027.013 Encrypted/Encoded File T1012 Query Registry T1083 File and Directory Discovery T1057 Process Discovery T1105 Ingress Tool Transfer T1055.001 Dynamic-link Library Injection T1016 System Network Configuration Discovery T1573.001 Symmetric Cryptography T1059.003 Windows Command Shell T1112 Modify Registry T1005 Data from Local System T1070.004 File Deletion T1106 Native API T1204 User Execution T1573 Encrypted Channel T1055 Process Injection T1203 Exploitation for Client Execution T1219 Remote Access Tools T1059 Command and Scripting Interpreter T1041 Exfiltration Over C2 Channel T1027 Obfuscated Files or Information

Reporting

Research mentioning Taidoor

Jul 15

Esentire

DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150's Evolving Tradecraft | eSentire

eSentire reported that a June 2026 intrusion against a finance-sector customer began with a ClickFix-style social engineering lure that triggered a malicious command, an MSI installer, and a multi-stage malware chain attributed to TAG-150. The infection sequence used an apparently AI-generated PowerShell script, Griffin20.ps1, to install the Deno runtime and launch the Deno-based loader DinDoor, which then deployed DenoRAT and ultimately NightshadeC2. Investigators said the malware communicated with command-and-control infrastructure including webstizkgao[.]com and used hard-coded JWTs carrying campaign identifiers such as buildId 0def066f14754be9 and buildNote LearnV7msi. The tooling provided broad post-compromise capability, with DenoRAT functioning as a RAT, loader, and stealer that supported command execution, persistence, host fingerprinting, file operations, screenshots, PTY and VNC-style remote control, and theft from browsers and cryptocurrency wallets. eSentire said the malware could also bypass Chromium App-Bound Encryption through DLL injection, a technique widely associated with in-memory execution, evasion, and abuse of legitimate Windows processes in ATT&CK T1055.001. The final NightshadeC2 payload was delivered through a PowerShell-driven Python in-memory loader, decrypted from an encrypted container using AES-256-CBC with a key derived from MoscauHighSmoke, and reflectively mapped into a Python process before the affected host was isolated and remediated.