AnonDoor
AnonDoor is a Python-based backdoor used by the Confucius cyber-espionage group in campaigns observed in 2025, particularly against targets in Pakistan. Reporting describes it as part of Confucius’ shift from document-stealing payloads such as WooperStealer toward longer-term monitoring, persistence, and interactive post-compromise access. Confucius is a long-running South Asia-focused espionage actor active since at least 2013 and has repeatedly targeted government agencies, military organizations, defense contractors, and critical industries, especially in Pakistan.
In the observed August 2025 intrusion chain, AnonDoor was delivered via malicious LNK attachments disguised as PDF documents, including NLC.pdf.lnk. The infection flow used DLL side-loading with a renamed copy of the legitimate Windows utility fixmapi.exe (e.g., BlueAle.exe) to load a malicious DLL, python313.dll. That DLL created a temporary PowerShell script, installed Scoop, configured a Python runtime, downloaded a Python bytecode payload from bloomwpp.info, and wrote it as %LOCALAPPDATA%\winresume.pyc with hidden attributes. Persistence was established through a scheduled task named NetPolicyUpdate that executed %USERPROFILE%\scoop\apps\python\current\pythonw.exe with winresume.pyc every 5 minutes.
AnonDoor performs host and network fingerprinting, including collection of system information, hardware UUID via "wmic csproduct get uuid", public IP discovery through services such as api.ipify.org, ipinfo.io/ip, icanhazip.com, and ifconfig.me/ip, and geolocation through ip-api.com and ipwhois.app. It inventories storage and enumerates drives, and one report notes use of GetDiskFreeSpaceExW and drive enumeration from A to Z. The malware contacts its command-and-control server and supports tasking including command execution, screenshot capture, file and directory listing, file download, folder download, and basic host information collection. Reporting also states it can dump browser credentials, with references to password theft from Firefox and Edge via additional Python tooling; one source also mentions Chrome password dumping. A timestamp file, %TEMP%\wctDD1A.tmp, was used to limit heavier tasks to no more than once every 6 minutes.
Associated infrastructure and indicators mentioned in the reporting include bloomwpp.info as delivery infrastructure for the Python-stage components, and broader campaign IOCs including marshmellowflowerscar.info, greenxeonsr.info, cornfieldblue.info, hauntedfishtree.info, petricgreen.info, dropmicis.info, and martkartout.info. The payload file winresume.pyc is specifically identified as the AnonDoor backdoor.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Python-based backdoor used in campaigns targeting multiple Southeast Asian countries.
Advanced Python backdoor (as described in the title).
Python-based backdoor deployed via LNK attachment and staged DLL sideloading, then persistence via scheduled task executing pythonw.exe with a downloaded .pyc. Capabilities include host fingerprinting/geolocation, drive enumeration, command execution, screenshot capture, file download/exfiltration, and fetching additional Python tools for browser credential theft (Firefox/Edge).
Python-based backdoor used in a Confucius APT campaign targeting Pakistan (delivered via spear-phishing per the content).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.