PassiveNeuron Cyberespionage Resurfaces: APT Abuses MS SQL Servers to Deploy Stealthy Neursite Backdoor

Kaspersky researchers have uncovered new details about PassiveNeuron, a long-running cyberespionage campaign targeting government, financial, and industrial organisations across Asia, Africa, and Latin America, which has re-emerged after a six-month dormancy and now deploys a multi-stage infection chain that abuses Microsoft SQL servers as initial entry points. Since December 2024, there has been a new wave of infections, with the latest ones dating back to August 2025, according to Kaspersky.

Three implants are identified: Neursite, a custom C++ modular backdoor; NeuralExecutor, a .NET-based loader; and Cobalt Strike used for post-exploitation and lateral movement, with the infection chain involving DLL loaders stored in System32 and using Phantom DLL Hijacking to maintain persistence.

The Neursite backdoor can use the TCP, SSL, HTTP, and HTTPS protocols for C2 communications and is capable of retrieving system information, managing processes, proxying traffic, and loading additional plugins for shell execution and file management, as noted by Kaspersky.

In 2025 variants, NeuralExecutor retrieves its C2 address from GitHub via a Dead Drop Resolver mechanism, where a string between specific delimiters is decoded to reveal the live C2 server address, a technique also seen in other Chinese-speaking campaigns. According to Kaspersky, these indicators point toward targeted espionage rather than mass exploitation, with MAC address checks further limiting execution to intended victims.