Researchers Identify PassiveNeuron APT Using Neursite and NeuralExecutor Malware

According to Kaspersky, government, financial, and industrial organisations in Asia, Africa and Latin America are the targets of a campaign dubbed PassiveNeuron, using Neursite and NeuralExecutor implants. The activity was first flagged by Kaspersky in November 2024 and described a campaign that began with attacks in June and evolved into a broader infection wave observed through August 2025.

In at least one incident, the adversary gained initial remote command execution on a Windows Server hosting Microsoft SQL, with possibilities that password brute‑forcing or an SQL injection flaw enabled access.

The operatives attempted to deploy an ASPX web shell to obtain command execution, but unsuccessful, before delivering advanced implants via a chain of DLL loaders placed in the System32 directory, including Neursite, a bespoke C++ backdoor, NeuralExecutor, a bespoke .NET implant, and the use of Cobalt Strike. NeuralExecutor variants were seen to retrieve C2 addresses from configuration in 2024, while 2025 artefacts reached out to a GitHub repository using a dead drop resolver technique.

The PassiveNeuron campaign has been noted as primarily targeting servers exposed to the internet, which researchers say can provide lucrative entry points for advanced persistent threats.