sesameop
SesameOp is a backdoor associated with a previously unknown APT group observed conducting cyber-espionage activity (reported as occurring in July 2025). The operation is notable for abusing the OpenAI Assistants API as a covert command-and-control (C2) channel—an extremely rare use of legitimate AI infrastructure for C2 compared to more common cloud-service abuse (e.g., Pastebin, OneDrive, Mega, Dropbox). Microsoft reported SesameOp used a trojanized Netapi64.dll loader and leveraged .NET AppDomainManager injection for persistence. Microsoft and OpenAI disabled the malicious accounts and API keys used for the C2 activity. No specific victim sectors, geographies, or additional aliases/sub-groups are provided in the source content beyond characterization as an unknown APT conducting cyber espionage.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Unknown APT group using the SesameOp backdoor to conduct cyber espionage, leveraging the OpenAI Assistants API as a C2 channel.
SesameOp is a backdoor that abuses the OpenAI Assistants API for covert command-and-control, hiding malicious traffic as legitimate API usage.
SesameOp is a backdoor that abuses the OpenAI Assistants API for covert command-and-control, hiding malicious traffic as legitimate API usage.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.