Malware
ReedBed
ReedBed, identified as a malware proxy backdoor, is suspected to be developed by QAKBOT devs, and was deployed by the threat actor Storm-1811 in campaigns observed during late October and early Novemb
ReedBed is a Windows malware family operated by MALLARD SPIDER and UNC4393.
Background
ReedBed is characterized as a proxy backdoor and is thought to originate from the QAKBOT developers. It was used by the threat actor Storm-1811 in operations seen in late October and early November 2024. Those operations usually begin with email bombing, a flood of bulk messages, after which the operator poses as help desk staff through social engineering to reach the target's systems.
Once running, ReedBed enforces a single instance using the mutex "JhishdiI2Uhsvoc94keiojn7ns19m0do" and hooks key system APIs (NtCreateUserProcess, RtlExitUserProcess) to evade defenses, interfere with processes, and resist termination. It pulls its Command and Control (C2) settings, generally from the "Software\TitanPlus" registry key, opens a long-lived SSL/TLS-encrypted channel, and sends an opening beacon with system details. From there it enters its primary loop, functioning as a flexible network proxy driven by C2 instructions: it can open outbound TCP connections, shuttle data in both directions, and stand up reverse SOCKS5 (with authentication) or straight TCP port-mapping services through locally opened listening ports. When instructed, or after a failed connection, it moves into a restart/wait cycle governed by registry values, using its hooked exit routine to block termination before trying to reach the C2 again.
Source: Malpedia (Fraunhofer FKIE).