Careful of the RemotePanel and BoundSiphon: A Dual-Payload Toolkit for Persistent Access and Browser Theft
Source Reddit Malware
Discussion
RemotePanel and BoundSiphon are two .NET malware components delivered together via malicious NuGet packages impersonating Chinese UI libraries. RemotePanel is a persistent remote access tool masquerading as the Windows Time service, providing extensive control over infected systems. BoundSiphon is an in-memory stealer targeting browser credentials, cryptocurrency wallets, password managers, and sensitive documents. The malware uses a blockchain-based mechanism to dynamically resolve its command and control servers, enabling infrastructure rotation without redeployment. The campaign involves typosquatting private or internal Chinese .NET libraries, affecting developer workstations and CI/CD environments. The malware ecosystem is modular, separating persistence from data theft, allowing operators to maintain capabilities while swapping components. Tens of thousands of downloads have been recorded, and the packages remain available on NuGet at the time of reporting. Blackpoint Cyber has detections for key behaviors in the infection chain, aiding defense despite evolving payloads and infrastructure.
r/Malware (opens in a new tab)u/blackpointcyber0 points0 comments
Tl:dr
- Blackpoint’s Adversary Pursuit Group (APG) identified two previously undocumented .NET malware components delivered together through a ClickFix chain: RemotePanel, a persistent remote access platform, and BoundSiphon, a credential and cryptocurrency stealer.
- RemotePanel establishes persistence by masquerading as the Windows Time service and gives operators broad control over infected systems, including PowerShell, file and process management, screen access, modular HVNC, and fleet management.
- RemotePanel uses a BNB Smart Chain contract to resolve its active Command and Control (C2) server, allowing operators to rotate infrastructure without rebuilding or redeploying the RAT.
- BoundSiphon runs primarily from memory and targets browser credentials and sessions, cryptocurrency wallets, password manager data, and selected documents, including secrets protected by Chromium App-Bound Encryption.
- APG identified strong code and build overlap between BoundSiphon and a stealer previously documented by Socket, linking the sample to an earlier stealer codebase or builder lineage.
- APG is seeking additional research and samples tied to RemotePanel, BoundSiphon, the AntiSNG implementation, Socket linked stealer activity, and the BNB Smart Chain resolver to help connect the remaining lineage and infrastructure gaps.
- RemotePanel and BoundSiphon reflect a broader shift toward modular malware ecosystems that separate persistent access from data theft, allowing operators to replace infrastructure and individual components while retaining the underlying capabilities needed to continue an operation.
- For victims, a single successful infection can lead to persistent remote access and theft of credentials, browser sessions, cryptocurrency wallets, password manager data, and other sensitive information, increasing the risk of account takeover, fraud, and continued compromise.
- Blackpoint has detections in place for key behaviors across the infection chain, providing coverage even as individual payloads and infrastructure change.