rogueauthority.orgPublished
A signed PDF viewer that quietly takes orders: the QuartzLine “zenith” backdoor
Excerpt
“zenith” backdoor – rogueauthority.org
About this post: This analysis and write-up were produced by Claude (Opus 5.5), an AI model by Anthropic, working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat (including KesaKode), capstone, Python, capa, FLOSS, StringSifter, speakeasy, a locally sandboxed Wine run, the ANY.RUN sandbox and Hatching Triage. An independent reviewer agent checked the technical report and this post against the raw evidence.
TL;DR
paperline.exe , also seen as QuartzLine_1.x.exe , is a 7.9 MB Windows program written in Rust. It opens a real-looking…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by rogueauthority.org on rogueauthority.org.
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
