PassiveNeuron Targets High-Profile Servers to Deploy Malware

A cyberespionage campaign dubbed PassiveNeuron has re-emerged after months of dormancy, with security researchers detailing its renewed activity and attack methods. The campaign, first detected in June 2024, targets government, financial and industrial organisations across Asia, Africa and Latin America with three distinct implants and previously unseen malware components, according to Securelist.

Investigators have identified that PassiveNeuron attackers primarily gain initial access by exploiting Microsoft SQL servers to infiltrate target networks, and then concentrate on compromising Windows Server machines by exploiting SQL software vulnerabilities or brute-forcing database administration credentials to run malicious commands.

Once inside, the group deploys ASPX web shells to maintain footholds, while repeatedly tweaking deployment techniques to evade detection, including switching between Base64 and hexadecimal encoding and moving from PowerShell to VBS scripts. The campaign’s arsenal includes Neursite, NeuralExecutor and the commercial Cobalt Strike, with first-stage DLLs inflated to over 100 MB to hinder analysis and MAC address verification checks to prevent sandbox execution.

Attribution is disputed, but researchers note indicators pointing toward Chinese-speaking threat actors, with 2025 NeuralExecutor samples showing GitHub-based configuration retrieval and other cross-links to prior operations.