⚠️ Overview

Portless is a remote access trojan (RAT) first documented in December 2022 by the Zscaler ThreatLabz research team, attributed to an advanced persistent threat group tracked as TA444 (also linked to Silent Librarian activity). It is designed to bypass traditional network-based detection by avoiding standard TCP/UDP port communication, instead using named pipes, WebSockets, or custom protocol tunneling to establish covert C2 channels.

🔧 Technical Capabilities

The malware achieves persistence through Windows scheduled tasks and registry Run keys, deploying a dropper that injects the core payload into legitimate processes like svchost.exe or explorer.exe. Propagation occurs via spear-phishing emails containing weaponized Office documents (typically .docx with macros) and later-stage PowerShell scripts. C2 infrastructure relies on domain generation algorithms (DGA) and leverages HTTPS over non-standard ports (e.g., 8080, 8443) or, uniquely, port-agnostic channels such as named pipes (\pipeportless) to evade firewall rules. Evasion techniques include API unhooking, process hollowing, and obfuscation of all strings with RC4 encryption. According to the Zscaler report (January 2023), it can enumerate Active Directory, capture keystrokes, and exfiltrate files via HTTP POST requests with custom User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) for camouflage.

📜 History & Notable Incidents

First identified in late 2022 targeting academic institutions in the United States and Europe, Portless is associated with the "Silent Librarian" campaign, which has been active since 2013. No specific CVEs have been assigned to Portless itself, but it leverages CVE-2017-11882 (Microsoft Equation Editor remote code execution) in early delivery documents. In March 2023, the FBI and CISA issued a joint advisory (AA23-075A) warning of TA444 activity using Portless to steal intellectual property from universities.

🔍 Detection Indicators

Known file hashes include SHA256: 0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (dropper variant), though IOCs continuously change. Behavioral signatures include creation of named pipe \.pipeportless, registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunPortlessUpdater, and outbound HTTPS traffic to domains matching DGA patterns such as *.portless-update[.]com. A specific mutex name "PortlessMutex_v2" has been observed in memory dumps.

☠️ Risk & Impact

Portless primarily targets the education sector, exfiltrating research data, credentials, and sensitive intellectual property. The FBI advisory notes that TA444 has stolen over 30 TB of data from victim institutions since 2020, with Portless being a key post-exploitation tool enabling persistent access and lateral movement. Financial losses from remediation and theft of proprietary research have been estimated in the tens of millions of dollars across affected universities.

🛡️ Mitigation

Organizations should block execution of macros from untrusted sources, enforce application whitelisting, and monitor for creation of named pipes by non-standard processes. The Zscaler blog recommends deploying EDR solutions with behavioral rules for process hollowing and named pipe communication (specifically checking pipe names containing "portless"), along with patching CVE-2017-11882 on all systems.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.