TiltedTemple__2022__PaloAltoNetworks_SockDetour-Fileless-Socketless-Backdoor_02-24-2022.pdf

Unit 42 describes SockDetour, a stealthy, fileless Windows backdoor used by the TiltedTemple APT campaign to maintain persistence and control by hijacking legitimate service ports and communicating with a remote operator over encrypted channels; the report links SockDetour to exploitation of ManageEngine vulnerabilities and compromised NAS devices, notes several targeted U.S. defense contractors, and indicates the tool has likely been in the wild since 2019.