Researchers Warn of MystRodX Backdoor Using DNS and ICMP Triggers for Stealthy Control

MystRodX, also known as ChronosRAT, is a stealthy backdoor disclosed by cybersecurity researchers that can manage files, forward ports, provide a reverse shell, and handle sockets, with its functions dynamically enabled by configuration. The code is delivered in a dropped form that checks for debugging or virtual machine environments before decrypting its next-stage payload, and the malware wires up with a dropper that uses a daytime launcher, a backdoor component called chargen, and BusyBox.

Its configuration is AES-encrypted and contains the C2 server details, backdoor type, and main and backup C2 ports, while the wake‑up mode allows it to act as a passive backdoor triggered by specially crafted DNS or ICMP traffic; if Backdoor Type is not 1, it operates in active mode and connects to the C2.

MystRodX can communicate using TCP or HTTP and can opt for plaintext or AES encryption for network traffic, enabling flexible, stealthy control, with activation timestamps suggesting activity since at least January 2024. The backdoor was first documented by Palo Alto Networks Unit 42 last month in relation to the CL-STA-0969 activity cluster, which is said to overlap with a China-nexus espionage group dubbed Liminal Panda, according to QiAnXin XLab.