DEEP#DOOR: The Python Backdoor That Disables Windows Security Before It Starts Collecting Everything It Can Find

What happened

Securonix researchers Akshay Gaikwad, Shikha Sangwan, and Aaron Beardslee disclosed the technical details of a Python-based backdoor framework called DEEP#DOOR on April 30, 2026. The malware arrives as a batch script named install_obf.bat, almost certainly distributed through phishing, and it begins by doing something that sets the tone for everything that follows: it disables Windows security controls before anything else happens.

The core Python implant is embedded directly inside the dropper batch script. When the batch file executes, it extracts the Python payload, reconstructs it, and launches it in memory. This design is deliberate. Embedding the payload inside the dropper removes the need to reach out to external infrastructure to download a second stage, which reduces network indicators and minimizes the forensic footprint. There is no separate download that a network monitoring solution might flag. The payload arrives with the dropper and is extracted at runtime.

Once the Python implant is running, it establishes communication with bore.pub, a Rust-based TCP tunneling service. Using a legitimate public tunneling service for command and control is a deliberate evasion choice. The attacker does not need to register or maintain dedicated infrastructure. The malicious traffic blends into normal network activity. The server address is not embedded in the payload in a way that makes it easily extractable, and the tunneling service itself is not inherently suspicious on enterprise networks that use similar tools for legitimate purposes.

The capability list is comprehensive:

• Reverse shell access
• System reconnaissance
• Keylogging
• Clipboard monitoring
• Screenshot capture
• Webcam access
• Ambient audio recording
• Web browser credential harvesting from Google Chrome, Mozilla Firefox, and Windows Credential Manager
• SSH key extraction
• Cloud credential theft targeting Amazon Web Services, Google Cloud, and Microsoft Azure

This is not a narrow, targeted theft tool. It is a platform for ongoing access and surveillance. The breadth of the collection capability suggests an operator interested in long-term persistent access and comprehensive intelligence gathering rather than a quick credential grab and exit.

The anti-analysis and defense evasion stack is equally extensive. DEEP#DOOR implements sandbox detection, debugger detection, and virtual machine detection before it proceeds with any malicious activity. It patches AMSI and ETW, which are two of the primary Windows mechanisms for detecting malicious scripts and collecting telemetry. It unhooks NTDLL to prevent security products from monitoring system calls. It tampers with Microsoft Defender, bypasses SmartScreen, suppresses PowerShell execution logging, wipes command-line history, stomps file timestamps, and clears event logs. Every layer of this evasion stack targets a different detection mechanism, and together they are designed to make the implant invisible to the security tooling most organizations rely on.

Persistence is layered across multiple mechanisms running simultaneously: Windows Startup folder scripts, Registry Run keys, and scheduled tasks. A watchdog mechanism continuously monitors whether any of these persistence artifacts have been removed and automatically recreates them if they have. Remediation is not a matter of deleting one registry key and rebooting. Every persistence mechanism needs to be identified and removed in coordination, and the watchdog process itself needs to be terminated before any of that removal is attempted, or it will simply undo the cleanup.

Who is affected

The full scope of DEEP#DOOR infections is not known at this time. The delivery mechanism is phishing, which means any Windows user who receives and executes the dropper is potentially compromised. The malware's specific interest in cloud credentials for AWS, Google Cloud, and Azure suggests that at least a portion of the targeting is oriented toward organizations with cloud infrastructure rather than purely consumer targets.

Environments at elevated risk include:

• Organizations with employees who regularly interact with external email and file attachments
• Development and engineering teams with access to cloud infrastructure credentials
• Environments where Windows endpoints are used to manage SSH keys, cloud accounts, or CI/CD systems

Risk level

High

DEEP#DOOR is a fully operational remote access trojan with a surveillance capability set that goes significantly beyond credential theft. Keylogging, webcam access, ambient audio recording, and reverse shell access together represent the ability to monitor a compromised machine comprehensively over an extended period. The evasion and anti-analysis stack is designed to make detection difficult, and the watchdog persistence mechanism is designed to make removal difficult. The combination produces a threat that is harder to detect, harder to remediate, and capable of substantially more harm than a typical information-stealing campaign.

What to do

1. Treat any execution of install_obf.bat or similar obfuscated batch scripts received through email or external channels as a high-severity incident requiring immediate containment
2. Hunt for bore.pub in network flow logs and DNS query logs as a potential indicator of active DEEP#DOOR command and control communication
3. Look for unexpected processes spawning Python interpreters from temporary directories or user-writable paths
4. Check for Startup folder scripts, Registry Run keys, and scheduled tasks that were not created by known software or system processes
5. Review Windows security telemetry for signs of AMSI patching, ETW patching, or NTDLL unhooking, which are indicators of active defense evasion
6. If compromise is suspected, do not attempt to remove persistence artifacts piecemeal. The watchdog will recreate them. Contain the endpoint first, then perform remediation from a known-good recovery environment
7. Reinforce phishing awareness training, particularly around executing batch scripts or installer files received from external sources
8. Enable application control policies that restrict execution of batch scripts from user-writable directories where feasible

Analysis

What makes DEEP#DOOR technically notable is not any single capability in isolation, but the deliberate care with which it manages detection risk at every stage of the intrusion chain. The payload is embedded in the dropper to avoid network download indicators. The command and control channel uses a legitimate public tunneling service to avoid infrastructure attribution. The evasion stack targets almost every layer of Windows security telemetry. The persistence is distributed across multiple mechanisms with an active watchdog to maintain it. None of these techniques are novel individually, but the combination reflects an operator who has thought systematically about where defenders are most likely to catch them and has taken steps to close each of those gaps.

The decision to embed the Python payload directly inside the dropper script is worth noting as a broader trend in malware development. Reducing external dependencies is a consistent theme because every external network call is a potential detection point. DEEP#DOOR takes this to a logical endpoint by making the dropper entirely self-contained. The trade-off is increased complexity and payload size in the dropper, but the evasion benefit clearly outweighs that cost from the attacker's perspective.

The watchdog mechanism is similarly instructive for defenders. Many incident response processes assume that removing a persistence artifact constitutes meaningful remediation. DEEP#DOOR's watchdog is a direct counter to that assumption, automatically reinstating anything that gets deleted. Effective remediation requires identifying all persistence components simultaneously and removing them as a coordinated operation after the watchdog process itself has been terminated. Doing it piecemeal will result in reinfection before the process is complete.

The cloud credential targeting is the detail that elevates organizational risk most significantly. AWS keys, Google Cloud service account credentials, and Azure tokens found on a compromised endpoint do not stay on that endpoint. They give an attacker the ability to pivot from a single phished workstation into an entire cloud environment, with consequences for data exfiltration, resource abuse, and lateral movement that can far exceed the impact of the original host compromise.