Kaspersky’s Global Research and Analysis Team (GReAT) has exposed an active, server‑focused cyberespionage campaign — tracked as PassiveNeuron — that specifically targets Windows Server hosts in government, financial and industrial networks across Asia, Africa and Latin America, with activity observed from December 2024 through August 2025.
PassiveNeuron is notable for its deliberate focus on servers — not just endpoint workstations — treating internet‑facing Windows Server systems as durable footholds for long‑term espionage. The campaign blends bespoke implants with widely available offensive tooling and a multi‑stage loader architecture designed to evade detection and maintain resilience if defenders remove individual components. Kaspersky first documented activity in 2024, observed a six‑month pause, then recorded renewed operations beginning in December 2024 and continuing into August 2025.
Key elements of the campaign include:
Key persistence/evasion techniques include:
Several industry writeups corroborate Kaspersky’s cautious stance, noting overlaps with techniques observed in other campaigns and reiterating that shared tooling (Cobalt Strike), loader architectures, and dead‑drop resolvers are not unique to a single actor. These cross‑industry observations argue for defensive focus on observable behavior and IOCs rather than firm declarative attribution.
Potential gaps and caveats in the public reporting:
Note: the user‑provided regional reporting also mirrors these points, emphasizing the campaign’s geographic spread and sector targets. This regional coverage is useful to understand victim distribution but does not add further technical artifacts beyond the vendor reports.
Source: Nigeria Communications Week Kaspersky Identifies PassiveNeuron Cyberespionage Campaign Targeting Windows Server Machines
PassiveNeuron is notable for its deliberate focus on servers — not just endpoint workstations — treating internet‑facing Windows Server systems as durable footholds for long‑term espionage. The campaign blends bespoke implants with widely available offensive tooling and a multi‑stage loader architecture designed to evade detection and maintain resilience if defenders remove individual components. Kaspersky first documented activity in 2024, observed a six‑month pause, then recorded renewed operations beginning in December 2024 and continuing into August 2025. Key elements of the campaign include:
- Two previously undocumented implants developed by the operators — Neursite (a modular native/C++ backdoor) and NeuralExecutor (a .NET‑based loader/implant).
- Repeated use of Cobalt Strike beacons for lateral movement and post‑exploitation tasks.
- A persistent, multi‑stage loader chain that abuses legitimate system load paths (System32 DLL placement and DLL hijacking techniques) and employs large, padded DLLs to frustrate quick triage and signature‑based detection.
Why this matters: servers as high‑leverage targets
Servers — especially internet‑facing database and web servers (Microsoft SQL Server, IIS, common web stacks) — are high‑value targets for espionage actors because:- A single compromised server can expose credentials, databases, and administrative tooling that enable domain‑level pivoting.
- Server‑side native modules and in‑memory loaders often bypass file‑centric security controls, increasing the chance of prolonged dwell time.
- Servers routinely contact cloud services and developer platforms, allowing attackers to blend command‑and‑control (C2) traffic into otherwise legitimate flows.
Technical breakdown
The implants: Neursite, NeuralExecutor and Cobalt Strike
- Neursite (native/C++ modular backdoor)
Neursite is a feature‑rich modular backdoor capable of: system inventory, process management, remote command execution, file operations, dynamic plugin loading and network proxying to route traffic through compromised hosts. Observed capabilities include support for multiple transport protocols (raw TCP, HTTP/S, SSL) and the ability to act as a pivot — tunnelling traffic to internal systems for reconnaissance and lateral movement. - NeuralExecutor (.NET loader/implant)
NeuralExecutor is designed to fetch and execute arbitrary .NET assemblies from its C2 infrastructure. It supports several communication channels — TCP, HTTP/S, WebSockets and even named pipes — and early samples showed ConfuserEx‑style obfuscation. Later variants employed a dead‑drop resolver technique (pulling encrypted payload/config blobs from public GitHub raw content) to avoid hard‑coded infrastructure, making takedown harder and blending malicious traffic with normal developer activity. - Cobalt Strike (commercial post‑exploitation framework)
The operators supplement bespoke implants with Cobalt Strike beacons to accelerate lateral movement, credential harvesting and privilege escalation tasks where commercial tooling offers quick operational leverage. This hybrid approach — bespoke implants for stealthy persistence and commodity tooling for rapid operations — is common among advanced persistent threat (APT) groups.
Loader chain and persistence mechanisms
The campaign’s persistence architecture relies on a layered, multi‑stage loader chain that commonly begins with a DLL dropped into the Windows System32 folder using names that mimic legitimate libraries (for example: wlbsctrl.dll, TSMSISrv.dll, oci.dll). The early‑stage DLLs are intentionally oversized — frequently exceeding 100 MB — containing large overlay sections filled with junk bytes to frustrate signature scanning and fast triage. These loaders then decrypt and load secondary payloads (AES/Base64 blobs in staging files), create suspended legitimate processes (WmiPrvSE.exe, msiexec.exe), inject shellcode and map final payloads into memory to avoid leaving clear artifacts on disk.Key persistence/evasion techniques include:
- Phantom DLL hijacking and abuse of legitimate service load paths to auto‑load malicious DLLs.
- Large overlay padding on DLLs to reduce signal for typical file‑size or heuristic checks.
- MAC address whitelisting and time‑of‑week activation windows to limit execution to targeted environments.
- Dead‑drop resolver usage (public GitHub blobs) for configuration and staged payload retrieval.
Initial access: SQL server abuse and web shells
In observed cases, the operators obtained remote command execution on Microsoft SQL Server instances and attempted to stage ASPX web shells via SQL‑executed OS commands. When those noisy web‑shell attempts were blocked, the adversary moved to multi‑stage loaders and in‑memory implants. This pattern — SQL abuse to stage web shells, then escalate to robust implants — offers defenders early detection opportunities if database and web logs are monitored closely.Attribution and analytical caution
Kaspersky assigns low‑confidence attribution to a Chinese‑speaking actor based on TTP overlap (dead‑drop patterns, reuse of certain PDB strings and other telemetry), but explicitly warns that artifacts such as Cyrillic strings, reused PDB paths, and other metadata can be intentionally manipulated as false flags. Analysts should therefore treat attribution as probabilistic and prioritize technical containment and remediation over geopolitical certainty.Several industry writeups corroborate Kaspersky’s cautious stance, noting overlaps with techniques observed in other campaigns and reiterating that shared tooling (Cobalt Strike), loader architectures, and dead‑drop resolvers are not unique to a single actor. These cross‑industry observations argue for defensive focus on observable behavior and IOCs rather than firm declarative attribution.
Practical detection and hunting guidance
Defenders should prioritize behavioral hunting signals and telemetry that capture the campaign’s unique operational fingerprints:- High‑value host‑level signals:
- Newly created or recently modified DLLs in C:\Windows\System32 with unusually large overlay sections (>10s of MB, often >100 MB).
- Suspicious process creation patterns: WmiPrvSE.exe, msiexec.exe or other legitimate hosts launched in suspended mode followed by memory writes (indicative of reflective loading).
- Creation of text staging files with large Base64 or AES‑like blobs in web roots or temp directories.
- Abnormal PowerShell command lines that decode and write ASPX/ASPXX payloads to web document roots.
- Named pipe or WebSocket activity originating from server processes — NeuralExecutor supports these channels.
- Network and SIEM signals:
- Unexpected GETs to public raw content endpoints (GitHub raw blobs) containing delimited payload markers.
- Long‑lived, low‑volume beaconing patterns and encrypted channels that mimic developer traffic.
- DNS or HTTP requests to domains/IPs associated with C2 or previously observed Cobalt Strike infrastructure.
- Recommended tooling and logging:
- Enable Sysmon with CreateRemoteThread, ImageLoaded, ProcessCreate, and network logging.
- Use memory‑capable EDR for in‑memory artifact detection and process injection indicators.
- Enable SQL Server auditing and forward SQL/IIS logs to SIEM for correlation with endpoint telemetry.
- Deploy file integrity monitoring and alerts for new executable/DLL additions to protected folders (System32, Program Files, web roots).
Containment, remediation and reconstruction advice
Because PassiveNeuron’s persistence design is redundant and layered, Kaspersky and responders recommend conservative containment planning:- Immediately isolate suspected hosts but preserve forensic images and volatile memory dumps before powering down.
- Export SQL Server and IIS logs; search for sp_executesql, xp_cmdshell usage, or anomalous sp_configure changes that execute shell commands.
- Rotate and disable credentials for service accounts, administrative accounts, and any suspected compromised keys or certificates. Assume domain credentials may be at risk if lateral movement is suspected.
- Block and sinkhole identified C2 domains/IPs and dead‑drop endpoints at the perimeter while preserving evidence for analysis.
- Rebuild and reimage affected servers from trusted golden images after thorough validation; incremental surgical removals often fail because alternate loaders and secondary backdoors remain.
Critical analysis — operator tradecraft, strengths and enterprise risks
PassiveNeuron demonstrates several operational strengths worth highlighting and countering:- Precision and stealth: MAC‑based whitelists and scheduled activation windows reduce accidental detonations and limit telemetry exposure, enabling low‑noise persistence in high‑value environments.
- Resilience through layered loaders: The multi‑stage chain and dynamic plugin support mean removing a single artifact rarely eliminates access — defenders must perform full scope analyses.
- Blending into legitimate traffic: Use of GitHub raw blobs or other public cloud services for dead‑drop resolvers complicates network detections and takedowns because such endpoints are legitimate developer resources.
- Combination of bespoke and commodity tooling: Bespoke implants (Neursite/NeuralExecutor) provide stealth and tailored capabilities while Cobalt Strike accelerates lateral movement, producing a flexible operational model.
Potential gaps and caveats in the public reporting:
- Attribution signals cited by vendors (PDB paths, Cyrillic strings) are fragile and easily manipulated; use them for correlation but not as sole proof of origin.
- IOCs like file hashes will age quickly; behavior‑based detections and playbooks are more durable.
Practical, prioritized hardening checklist (for Windows Server owners)
- Reduce attack surface
- Restrict internet exposure of SQL Server, IIS and management ports; use allow‑lists and VPN gateways.
- Harden database features
- Disable xp_cmdshell and other OS‑execution SQL features unless strictly required and audited.
- Enforce least privilege
- Limit service account rights; rotate credentials on detection.
- Monitor and log aggressively
- Turn on SQL auditing, IIS logging, Sysmon, EDR telemetry and forward to SIEM for correlation.
- Hunt for high‑signal artifacts
- Search for unusually large DLLs under System32, staging files with large Base64/AES blobs and suspended process memory writes.
- Protect developer/third‑party channels
- Monitor and anomaly‑detect raw content fetches to public cloud services (GitHub raw, cloud storage) from server hosts.
- Prepare for rebuilds
- Maintain golden images and practice fast rebuild playbooks rather than relying on incremental cleanup.
- Invest in people and intelligence
- Provide SOC teams with current threat intelligence feeds and scenario‑based training that includes targeted APT playbooks.
Cross‑validation of claims and sources
Kaspersky’s own press release and Securelist technical blog present the most comprehensive technical details for PassiveNeuron: implant names, loader behaviors, SQL server abuse and dead‑drop techniques. These findings are independently echoed by SecurityWeek and technical outlets such as TechNadu and other regional cybersecurity news sites, which corroborate the timeline (December 2024 — August 2025), the server focus, and the use of Neursite, NeuralExecutor and Cobalt Strike. This cross‑industry agreement strengthens confidence in the observable technical claims while leaving attribution deliberately conservative.Note: the user‑provided regional reporting also mirrors these points, emphasizing the campaign’s geographic spread and sector targets. This regional coverage is useful to understand victim distribution but does not add further technical artifacts beyond the vendor reports.
What security teams should do right now
- Treat all internet‑exposed Windows Server machines — especially SQL and IIS hosts — as high‑priority assets and apply the hardening checklist above immediately.
- Integrate behavioral hunting rules described here into daily SOC playbooks: large System32 DLLs, suspended process patterns, SQL‑initiated OS command execution and unexpected public raw blob fetches.
- Capture memory and disk images of any suspected host before remediation, and assume full rebuild is likely the safest remediation route.
- Adopt a defensive posture that emphasises detection, containment and eradication based on observable behavior — not solely on probabilistic attribution — and coordinate with threat intelligence providers for tailored IOCs mapped to your environment.
Conclusion
PassiveNeuron is a textbook example of modern server‑centric espionage: bespoke implants, resilient multi‑stage loaders, and operational discipline designed to limit detection and maximize longevity inside high‑value networks. The campaign underscores the urgent need for defenders to treat servers as first‑class citizens of the security estate: reduce exposure, gather richer telemetry, and prioritise behavioral detection and rapid rebuild playbooks over brittle, signature‑only strategies. Kaspersky’s disclosure provides actionable hunting signals and containment guidance; organizations that operationalize these recommendations — from SQL hardening and Sysmon telemetry to incident rehearsal and EDR memory‑capable defenses — will materially reduce their risk of becoming the next PassiveNeuron victim.Source: Nigeria Communications Week Kaspersky Identifies PassiveNeuron Cyberespionage Campaign Targeting Windows Server Machines