MystRodX: A Stealthy New Backdoor Found Hiding in Networks for Over 20 Months

MystRodX, a stealthy backdoor uncovered by XLab, appeared in the wild as a brand-new family with unique encryption layers and activation mechanisms, after being initially mistaken for Mirai. On 6 June 2025, suspicious activity from an IP address distributing a binary named dst86[.]bin prompted further investigation, with VirusTotal giving it a low detection rate of 4/65 and labeling it Mirai, though XLab’s AI module disagreed.

According to XLab, MystRodX is written in C++ and can manage files, forward ports, provide a reverse shell and SOCKS proxy, but its real strength lies in its stealth and configurability via a differentiated encryption strategy for sensitive information. It can switch between TCP or HTTP communications and toggle between plaintext or AES-encrypted traffic depending on configuration, and it features a passive wake-up mode activated by specific DNS or ICMP packets without requiring open ports.

DNS triggers embed hidden Base64 payloads to activate the backdoor and connect to a C2 server, while ICMP triggers direct encrypted instructions to direct connections over TCP or HTTP. Analysis also shows activation timestamps as far back as 7 January 2024, suggesting the malware may have lurked in networks for over 20 months undetected, with three live C2 servers identified and some RSA keys linked to prior campaigns.

Defender guidance from XLab urges monitoring for unusual DNS or ICMP payloads, hunting unexplained connections to C2 IPs such as 149.28.137[.]254, 156.244.6[.]68 and 185.22.153[.]228, and deploying behaviour-based detection to catch the dual-process persistence mechanism.