Sleep Mode for Detection but Alive in the Shadows

MystRodX backdoor, active since Jan 2024, uses encrypted payloads and DNS/ICMP triggers for stealthy C2 control.

Explore the latest news, real-world incidents, expert analysis, and trends in September 2025 — only on The Hacker News, the leading cybersecurity and IT news platform.

A suspected Chinese-speaking threat actor has launched a new campaign against government-related organizations across Central Asia and the Syrian Arab Republic using the backdoors OctLurk and SilkLurk, alongside the proxying tool LurkProxy. The malware operates largely in memory, supports extensive post-compromise activity, and shows infrastructure overlap with the SilentRaid, MystRodX, and...

A new report reveals MystRodX, a stealthy backdoor that uses passive wake-up triggers and multi-layer encryption to operate undetected in networks for months.

Cybersecurity researchers have disclosed a stealthy new backdoor called MystRodX that comes with a variety of features to capture sensitive data from compromised systems. "MystRodX is a typical backdoor implemented in C++, supporting features like file management, port forwarding, reverse shell, and socket management," QiAnXin XLab said in a report published last week. "Compared to typical

Introduction A chilling new cyber weapon has entered the digital battlefield—MystRodX, also known as ChronosRAT. Unlike ordinary malware, this stealthy backdoor is designed with espionage-level precision, capable of silently stealing data, hiding its tracks, and adapting to multiple network environments. First documented in 2024, MystRodX has already been linked to advanced threat actors with ties to state-backed espionage. Security experts warn that this malware is not just another infection—it represents a new wave of stealth-oriented cyberattacks designed to evade even the most advanced defenses.

DNS ICMP Data Exfiltration - Security researchers at XLab have exposed MystRodX, a sophisticated backdoor masquerading as Mirai but delivering

MystRodX backdoor, active since Jan 2024, uses encrypted payloads and DNS/ICMP triggers for stealthy C2 control.

MystRodX backdoor, active since Jan 2024, uses encrypted payloads and DNS/ICMP triggers for stealthy C2 control.

DNS ICMP Data Exfiltration - Security researchers at XLab have exposed MystRodX, a sophisticated backdoor masquerading as Mirai but delivering

Cybersecurity researchers have disclosed a stealthy new backdoor called MystRodX that comes with a variety of features to capture sensitive data from compromised systems. "MystRodX is a typical backdoor implemented in C++, supporting features like file management, port forwarding, reverse shell, and socket management," QiAnXin XLab said in a report published last week. "Compared to typical