New “YiBackdoor” Malware Lets Hackers Run Commands and Steal Data

Cybersecurity researchers at Zscaler ThreatLabz have identified YiBackdoor, a sophisticated new malware strain first detected in June 2025, which shares substantial code similarities with IcedID and Latrodectus. The backdoor is designed to give attackers persistent, broad control over infected systems, including collecting system information, capturing screenshots, and executing arbitrary commands via Command Prompt and PowerShell, with support for plugins to extend functionality.

It employs multiple anti-analysis techniques, including dynamic API resolution with a hash-based lookup and obfuscation, and actively detects virtualization through CPUID, SwitchToThread, and RDTSC timing methods to evade sandboxes. For persistence, YiBackdoor uses the Windows Run registry key via a multi-stage approach, copies itself to a random directory, creates a regsvr32-based registry entry, and then self-deletes the original file to hinder forensics.

Its C2 traffic is encrypted using a JSON-based protocol with daily-changing keys, and commands are delivered and responses returned via HTTP POST, with six primary command types and Base64-encoded outputs. Current intelligence suggests YiBackdoor remains in development or limited testing phases. According to the article by GBHackers, the malware’s design mirrors that of banking trojans repurposed for initial access in ransomware operations.