f2dec56acef275a0e987844e98afcc44bf8b83b4661e83f89c6a2a72c5811d5f

MediaPl custom backdoor (MediaPl.dll) masquerading as Windows Media Player, attributed by Microsoft in January 2024 to a Mint Sandstorm subgroup (APT35 / Charming Kitten / Phosphorus) targeting Middle East affairs researchers at universities in BE, FR, IL, UK and US. Communicates with C2 via AES-CBC encrypted, Base64-encoded channels.

family

MediaPl

first seen

Oct 31, 2023

publisher

Microsoft