An espionage group operating under the name StingyBasilisk has been using Windows named pipes combined with the SMB protocol to spread malware across highly isolated government networks. According to cybersecurity specialists, the group has been active since at least April 2022, maintaining a stealthy presence by masquerading its tools as legitimate security components.
How the Attack Works
StingyBasilisk deploys custom agents controlled via named pipes—a Windows inter-process communication mechanism. Because named pipe traffic looks like normal system activity, its communication often passes under the radar of traditional monitoring. Researchers found that all malware samples were delivered as DLLs which remain in memory, avoiding any obvious traces on disk.
The initial infection vector is unclear, but lateral movement within victim networks occurred starting in February 2026. Attackers spread malicious files via SMB, placing them in the C:\Windows\Temp directory. They used a tool called atexec from the Impacket suite, which submits tasks through Windows Task Scheduler over the SMB channel via the named pipe \pipe\atsvc. These tasks are given random GUID-style names to avoid detection.
Persistence Mechanisms & Backdoors
To survive reboot cycles, the group uses two less common tactics. First, COM hijacking: they overwrite registry entries (specifically the TreatAs key) for components like the Network List Manager and Network Configuration, so Windows loads malicious DLLs in place of legitimate ones. Among these hijacked components are Shadow COM libraries like netprofmprox.dll, which mimic legitimate ones closely.
Second, the attackers hijack the Windows Time service by introducing their own provider via the W32Time\TimeProviders registry key. This allows their code to be loaded into svchost.exe under the Local System account at every boot. A loader, named TediousLoader, opens raw sockets on all network adapters, listening for inbound packets marked by a secret signature. Once received, those packets are decrypted using AES-256 and executed in memory.
Command & Control, and File Operations
Named pipes serve not just for persistence but also command and control. A loader named CunningDoor is sideloaded via a signed SafeNet DLL, which then triggers a malicious DLL using rundll32. Another tool observed is HenMapCaCon.dll, written in Go—this backdoor runs a TLS server over a named pipe and can exfiltrate files from compromised systems.
Defense researchers tracked specific named pipe naming patterns and managed to capture and decrypt payloads by matching those patterns. They also recovered indicators such as altered ChaCha20 constants and a hardcoded server public key.
Indicators & Mitigation
Key indicators of compromise include files in C:\Windows\Temp, named pipes like \pipe\atsvc, suspicious DLLs sideloaded through signed libraries, and registry entries altered for TreatAs and TimeProviders keys. Malicious loaders like netprofmprox.dll, netcfgprox.dll, or Time Provider DLLs (e.g.wgtdgr.dll, HenMapCaCon.dll) are linked to the campaign.
To defend against this type of intrusion, organizations are urged to limit SMB access between segmented networks, monitor task scheduler event logs, audit registry keys for unusual TreatAs or TimeProviders modifications, and scan for unexpected DLLs within system folders. Also, logging named pipes traffic that match known naming patterns and watching for altered cryptographic constants could be crucial in detecting similar attacks early.
StingyBasilisk fulfills a worrying profile: patient, stealthy, and capable of navigating security perimeters once inside. The use of in-memory malware, signed libraries for sideloading, and registry hijacks underscores that even hardened networks are vulnerable when attackers exploit standard Windows features. The lesson: isolation alone isn’t enough. Monitoring and defense need to reach into the fabric of system operations to catch abuse of trusted channels.
