BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

As cited

Copy frozen at 2026-09-19 06:17 UTC (site build).

threat intel

BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

Elastic Security Labs identified BITSLOTH, a Windows backdoor that uses the Background Intelligent Transfer Service (BITS) for command and control communications. The malware was discovered during analysis of activity attributed to a threat group tracked as REF8747.

Why it matters: Windows administrators and security teams need to monitor BITS traffic and activity group REF8747 campaigns for signs of this backdoor, as it exploits a legitimate Windows service to evade detection.

Source published

2024-08-01 00:00 UTC

First seen by Cybersecurity Tracker

2026-09-19 05:23 UTC