Cybersecurity researchers have disclosed details of a stealthy Python-based backdoor framework called DEEP#DOOR, designed to establish persistent access on Windows systems and harvest sensitive information from compromised hosts.
According to Securonix Threat Research, DEEP#DOOR uses an obfuscated batch script named install_obf.bat to disable security controls, extract an embedded Python payload called svc.py, and deploy a persistent Remote Access Trojan. The malware uses multiple persistence techniques, including Startup folder scripts, registry Run keys, scheduled tasks, optional WMI subscriptions, and watchdog mechanisms that can recreate removed persistence artifacts.
A Targeted Python-Based Backdoor
At this stage, researchers have not confirmed that DEEP#DOOR is being used in a large-scale campaign. Securonix told The Hacker News that current evidence suggests limited and somewhat targeted usage rather than broad distribution.
The malware is believed to be distributed through traditional methods such as phishing, although the full delivery chain and victim profile remain unclear. What makes the framework notable is not necessarily its scale, but its design: it is stealthy, modular, script-driven, and built for long-term access.
Embedded Payload Delivery
One of the most interesting aspects of DEEP#DOOR is that the Python implant is embedded directly inside the dropper script.
Instead of repeatedly downloading the main payload from external infrastructure, the batch script extracts and reconstructs the Python component at runtime. This reduces external dependencies and limits some traditional network-based detection opportunities.
In simple terms, the infection chain looks like this:
Phishing or initial delivery
↓
install_obf.bat
↓
Security controls disabled
↓
Embedded Python payload extracted
↓
Persistence created
↓
DEEP#DOOR RAT active
This approach helps the malware keep a smaller forensic footprint and makes the initial loader harder to analyze with simple static detection.
Command and Control Through Public Tunneling
Once active, DEEP#DOOR communicates through bore[.]pub, a public TCP tunneling service. Securonix reports that this allows the attacker to establish remote access without embedding a fixed command-and-control server directly into the payload.
Using a public tunneling service gives attackers several advantages:
- 🌫️ traffic may blend with legitimate tunneling activity
- 🧱 no need to maintain obvious dedicated infrastructure
- 🔁 infrastructure details can remain outside the payload
- 🕵️ detection becomes harder if defenders only focus on known malicious domains
This is part of a broader trend where attackers abuse legitimate services and infrastructure to make malicious activity look less suspicious.
What DEEP#DOOR Can Do
DEEP#DOOR operates as a full-featured Remote Access Trojan. Once deployed, it can support remote control, surveillance, credential theft, and post-exploitation activity.
Reported capabilities include:
- 🖥️ reverse shell access
- 🔍 system reconnaissance
- ⌨️ keylogging
- 📋 clipboard monitoring
- 📸 screenshot capture
- 🎥 webcam access
- 🎙️ ambient audio recording
- 🌐 browser credential harvesting
- 🔑 SSH key extraction
- 🪪 Windows Credential Manager theft
- ☁️ cloud credential theft from AWS, Google Cloud, and Microsoft Azure environments
Securonix specifically notes that the malware can harvest credentials from Google Chrome, Mozilla Firefox, Windows Credential Manager, SSH key stores, and major cloud provider credential locations.
Heavy Defense Evasion
DEEP#DOOR includes a wide range of anti-analysis and defense evasion techniques.
Researchers observed capabilities such as sandbox detection, debugger detection, virtual machine detection, AMSI patching, ETW patching, NTDLL unhooking, Microsoft Defender tampering, SmartScreen bypass, PowerShell logging suppression, command-line wiping, timestamp stomping, and log clearing.
This matters because the malware is not only trying to gain access. It is actively trying to reduce visibility for defenders and complicate incident response.
Persistence That Rebuilds Itself
Persistence is one of the strongest parts of the DEEP#DOOR framework.
The malware can create multiple persistence mechanisms across Windows, including Startup folder scripts, registry Run keys, scheduled tasks, and optional WMI event subscriptions. Securonix also reports watchdog self-healing threads, meaning the malware can monitor whether its persistence artifacts have been removed and recreate them if needed.
That makes remediation more difficult. Removing one registry key or scheduled task may not be enough if another component is monitoring and restoring access.
Why This Threat Matters
DEEP#DOOR highlights a continued shift toward fileless-style, script-driven intrusion frameworks.
Instead of relying on a traditional executable that is easy to hash, scan, and block, attackers increasingly use scripting languages, native Windows components, and interpreted runtimes such as Python. This gives them more flexibility and can make detection harder if security tools are focused mainly on suspicious binaries.
The bigger lesson is that modern malware does not always look like a classic .exe file. It may arrive as a script, run through trusted system components, extract code at runtime, and communicate through legitimate services.
Defensive Recommendations
Organizations should focus on behavior-based detection and hardening rather than relying only on signature-based blocking.
Recommended actions include:
- ✅ monitor execution of suspicious
.bat,.cmd, Python, and PowerShell scripts - ✅ alert on scripts disabling Windows Defender, SmartScreen, AMSI, ETW, or logging
- ✅ watch for unusual Python execution from temporary or user profile paths
- ✅ monitor Startup folder, registry Run keys, scheduled tasks, and WMI persistence
- ✅ detect unusual outbound tunneling activity, especially to public tunneling services
- ✅ review access to browser credential stores, SSH keys, and cloud credential files
- ✅ alert on command-line wiping, timestamp stomping, and suspicious log clearing
- ✅ restrict script execution where possible through application control
- ✅ use EDR detections focused on process behavior and parent-child relationships
- ✅ train users to treat unexpected batch scripts, installers, and archive attachments as suspicious
For cloud security teams, it is also important to monitor for unusual access to AWS, Google Cloud, and Azure credentials from endpoints, especially if those systems are not normally used for cloud administration.
User Awareness Message
A simple internal warning could be:
🚨 Do not run unexpected batch files, scripts, or “fix tools” received by email or downloaded from unverified sources. If a script claims to repair, update, or secure your system, verify it with IT first.
This is especially important for technical users, administrators, developers, and anyone with access to cloud credentials or privileged systems.
Final Thoughts
DEEP#DOOR is not just another credential stealer. It is a stealthy Python-based backdoor framework designed for persistence, surveillance, credential theft, and remote control.
Its use of embedded payload extraction, public tunneling infrastructure, multiple persistence layers, and extensive defense evasion shows how modern malware is becoming more modular and harder to remove.
🐍 Script-based malware is becoming a serious enterprise threat.
Organizations should treat Python, batch scripts, and native Windows tooling as part of their detection surface — not as harmless administrative noise.
