PassiveNeuron: a sophisticated campaign targeting servers of high-profile organizations

According to Securelist, PassiveNeuron is a sophisticated cyberespionage campaign that has targeted Windows Server machines, deploying three implants across its operations: Neursite, a custom C++ backdoor; NeuralExecutor, a .NET loader; and the Cobalt Strike framework. The attackers used a multi-stage DLL loading chain, placing first-stage DLLs in system directories and employing Phantom DLL Hijacking to persist and run payloads, with some DLLs exceeding 100 MB in size due to junk overlay bytes.

On several targets, the operation began with remote command access via Microsoft SQL Server, followed by attempts to deploy an ASPX web shell, which were interrupted by Kaspersky protections and led to the deployment of more advanced implants. The Neursite backdoor can connect via TCP, SSL, HTTP or HTTPS to C2 servers, while NeuralExecutor can receive additional .NET payloads and run them, using ConfuserEx obfuscation in some samples.

The researchers note attribution is challenging but suggest the campaign most closely resembles techniques used by Chinese-speaking threat actors, albeit with low confidence. The latest infections were observed from December 2024 to August 2025, targeting government, financial and industrial organisations in Asia, Africa and Latin America.