A new sophisticated backdoor malware named HTTPtroy has been discovered masquerading as a VPN service to evade detection and maintain persistent access on compromised systems. HTTPtroy is designed to blend in with legitimate network traffic by mimicking VPN protocols, making it difficult for traditional security tools to identify its malicious activity. This backdoor allows attackers to remotely control infected machines, steal sensitive data, and deploy additional payloads without raising suspicion. The malware employs advanced techniques such as encrypted communications, stealthy command and control (C2) channels, and modular architecture to enhance its resilience and adaptability. Security researchers warn that HTTPtroy is likely being used by a well-resourced threat actor group targeting enterprises across various sectors, including finance, healthcare, and government. Organizations are advised to monitor network traffic for unusual VPN-like connections, update endpoint protection systems, and apply threat intelligence to detect and mitigate this emerging threat. This discovery highlights the evolving tactics of cybercriminals leveraging legitimate service impersonation to bypass security defenses and underscores the importance of continuous monitoring and advanced threat detection capabilities.
This Cyber News was published on thehackernews.com. Publication date: Tue, 04 Nov 2025 01:14:03 +0000