IntroductionCheck Point Research identified an ongoing operation against targets in North Africa involving a previously undisclosed multi-stage backdoor called Stealth Soldier. Stealth Soldier is a custom implant, likely used in a limited set of targeted attacks. Execution FlowThe execution flow for all Stealth Soldier versions begins with the execution of the downloader, which triggers the infection chain. The workflow below details the full execution scheme of Stealth Soldier Version 9. VersionsWe observed 3 infection chains of Stealth Soldier malware with different versions depending on the payload – 6, 8 and 9.

Source: The North Africa Journal June 08, 2023 08:13 UTC