Deep#Door hides a Python RAT inside a batch file, kills Windows defenses, survives via multiple persistence methods, and exfiltrates data through a public TCP tunnel.

Security researchers at Securonix uncovered a sophisticated malware campaign called Deep#Door. Threat actors employed a stealthy Python-based backdoor that uses a surprisingly simple delivery method to achieve deep, persistent access on Windows systems. What makes the campaign stand out is not just what it can do, but how cleverly it avoids being caught doing it.

“Unlike traditional malware loaders that rely on external payload downloads, Deep#Door embeds its Python implant directly inside the dropper script and reconstructs it in-memory and on disk during execution.” reads the report published by Securonix. “The implant then establishes communication with attacker infrastructure hosted on bore[.]pub, a publicly available TCP tunneling service, enabling stealthy remote access without exposing dedicated C2 servers.”

The attacK chain starts with a single batch file: install_obf.bat. When executed, this script reads itself, literally parsing its own contents to extract a hidden Python payload embedded directly inside the script. The extracted file, svc.py, is then written quietly to %LOCALAPPDATA%\SystemServices\, a folder name deliberately chosen to blend in with legitimate Windows components.

This self-referential technique is a key reason the malware is hard to catch early. There are no suspicious downloads, no external URLs being contacted at the staging phase, and no compiled executables to flag. It’s all happening within a script that looks, at first glance, like a routine maintenance tool.

Before doing anything else, the loader systematically dismantles the host’s defenses: Windows Defender is disabled, PowerShell logging is turned off, firewall logging is suppressed, and SmartScreen is bypassed. By the time the Python implant activates, the system is effectively blind.

“The malware incorporates numerous advanced anti-analysis and defense evasion mechanisms including sandbox detection, AMSI and ETW patching, ntdll unhooking, Windows Defender tampering, command-line wiping, timestamp stomping, and log clearing.” continues the report.

Deep#Door doesn’t rely on a single method to survive reboots. It plants itself across multiple locations simultaneously, the Windows Startup folder, registry Run keys, scheduled tasks, and even WMI event subscriptions. On top of that, a background watchdog thread constantly monitors these persistence points and automatically restores any that get deleted.

In practice, this means that simply removing one artifact doesn’t clean the infection. All mechanisms need to be addressed at the same time, which makes manual remediation unusually difficult.

Before fully activating, the malware runs a series of checks to determine whether it’s running on a real machine or inside an analysis environment. It looks for debuggers, virtual machine signatures, sandbox indicators like generic usernames or low system resources, and even security research tools like Wireshark or IDA Pro.

If anything looks suspicious, the malware holds back. This helps it evade automated scanning platforms, which typically analyze samples in virtual or sandboxed environments.

For command-and-control, Deep#Door takes an unconventional approach. Instead of connecting to a dedicated attacker server, which would be easier to detect and block, it uses bore.pub, a legitimate public TCP tunneling service.

The malware scans a dynamic range of ports to find an active tunnel, authenticates using a challenge-response mechanism, and establishes a covert channel that looks like ordinary tunneling traffic.

“Instead of relying on a traditional C2 server, the malware leverages bore.pub,” states the cybersecurity firm, “a public TCP tunneling service:

• Allows attackers to expose internal services to the internet without opening firewall ports
• Eliminates the need for attacker-owned infrastructure
• Blends malicious traffic with legitimate tunneling usage

This significantly complicates attribution and network-based detection, as traffic appears to connect to a legitimate service.”

This makes attribution harder and network-based detection less reliable, since the traffic blends with legitimate use of the same service.

Once active, the implant is a fully featured remote access tool. Operators can execute shell commands, capture screenshots, record audio, log keystrokes, access the webcam, harvest stored passwords from browsers, steal SSH keys and cloud credentials, and scan internal networks. At the destructive end, it can also overwrite the Master Boot Record or force a system crash, these capabilities that suggest it could shift from espionage to sabotage if needed.

Securonix recommends focusing detection efforts on behavioral signals rather than file signatures: PowerShell commands that reference %~f0 (a self-file marker), file writes to SystemServices directories, modifications to Defender settings or event log services, and outbound connections to bore.pub across ports 41234–41243.

“Deep#Door highlights the continued evolution of threat actors toward fileless, script-driven intrusion frameworks that rely heavily on native system components and interpreted languages like Python. By embedding the payload directly within the dropper and extracting it at runtime, the malware significantly reduces external dependencies and limits traditional detection opportunities.” concludes the report.

“The use of public tunneling infrastructure (bore[.]pub) further eliminates the need for dedicated attacker-controlled servers, enabling covert and resilient command-and-control communications that blend with legitimate traffic patterns.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Deep#Door)

---

---