Latest
Tag: backdoor
The captcha that can’t be passed: a signed “Installer.exe” that plants a remote-control updater
A signed Installer.exe shows a slide-to-verify captcha that always fails, while silently installing an updater that downloads and runs whatever a Cloudflare R2 manifest lists. The manifest was…
A signed PDF viewer that quietly takes orders: the QuartzLine “zenith” backdoor
An EV-signed Rust PDF viewer, QuartzLine, hides a backdoor module called zenith that can run commands and tamper with browser profiles. We decrypted its C2 traffic; public sandboxes…
A signed “video editor” that fakes its own failure and leaves two back doors behind
A signed fake video-editor installer shows a robot check and a fake driver error while installing two separate back doors: a SYSTEM service and a Node.js program that…
The PDF Viewer That Makes Sandboxes Wait It Out
A signed "PDF viewer" that guesses its own key 3.7 billion times to outlast sandboxes, then hides a DHT-and-DGA backdoor inside Windows Explorer.
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects