REF8747 group deploys BITSLOTH backdoor using Windows BITS for C2

1. Executive summary

Elastic Security Labs has documented BITSLOTH, a Windows backdoor that uses the Background Intelligent Transfer Service (BITS) for command-and-control, found on a server during an intrusion into the Foreign Ministry of a South American government in June 2026. The activity group is tracked as REF8747; no MITRE ATT&CK profile exists for it, so attribution is unconfirmed and the operator behind the tool is unknown. The current build carries 35 handler functions including keylogging and screen capture, and Elastic assesses it as a data-gathering tool. No CVE is associated with this item and no CISA KEV entry applies, so the exposure is to hands-on intrusion tradecraft (side-loading, shellcode loaders, proxy tunnelling) rather than a patchable flaw. EMEA financial services firms should treat the tooling as a detection-engineering problem: signed-binary side-loading and BITS-based C2 are both low-noise on most estates.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

BITSLOTH is a Windows backdoor written as a DLL, delivered by side-loading a signed copy of the music production program FL Studio. Elastic found it on a server environment on 25 June 2026 during an intrusion into the Foreign Ministry of a South American government. The actor used mostly publicly available tooling, with BITSLOTH the custom component. The chain below is what Elastic confirmed from the intrusion and from sample analysis.

1. Initial access and lateral movement. The intrusion was traced to PsExec execution on one of the infected endpoints. Elastic does not state the initial access vector, so how the actor first entered the estate is not established in the source.
2. Defence evasion via shellcode loader. The actor used RINGQ, a shellcode loading project that works like DONUTLOADER: it converts a Windows executable into custom shellcode and writes it into a file named main.txt. The shellcode is decrypted and executed in memory, which defeats defences that rely on hash blocklists or static signatures. Elastic observed RINGQ used to load the IOX port forwarder.
3. Tunnelling. The actor used STOWAWAY to proxy encrypted traffic over HTTP to its C2 servers. Elastic notes proxy tools, tunnelers and redirectors are used to conceal the responsible adversary, bypass internal network controls, and provide terminal access, encryption and file transfer.
4. Execution and side-loading. The actor dropped BITSLOTH as flengine.dll inside the ProgramData directory and executed the legitimate FL Studio binary fl.exe. The call stack from the resulting process-injection alert shows the load path through c:\programdata\pl studio\fl.exe into c:\programdata\pl studio\flengine.dll, with unbacked memory regions (Unbacked!0x14EAB23, Unbacked!0x14EA8B6) between the loader frames and the ntdll/kernelbase/kernel32 frames. The in-memory DLL was extracted from a region with Read/Write/Execute page protections. Note the directory in the call stack reads pl studio while the prose says ProgramData; both appear in the source and the discrepancy is not explained there.
5. Capability. The current iteration has 35 handler functions, including keylogging and screen capture, plus features for discovery, enumeration and command-line execution. Elastic assesses the tool is designed for gathering data from victims.

Command-and-control runs over BITS. The developer's own terminology in the project calls BITSLOTH the "Slaver" component and the C2 server the "Master" component, and a PDB path in the samples reflects this. Older samples show development since December 2021, with distinct versions uploaded to VirusTotal over that period.

The malware has no control-flow obfuscation and no string encryption. Older and recent samples both carry logging and debugging strings, including a Simplified Chinese wide-character string in the .rdata section at startup that translates to a message about a program already running. That string is a language artefact, not evidence of the operator's location, and Elastic does not attribute the tool.

Confidence caveats. The entire technical picture rests on a single vendor report (Elastic Security Labs); no second source corroborates the file paths, the RINGQ or STOWAWAY usage, or the BITS C2 mechanism. The actor name REF8747 is Elastic's tracking label and has no MITRE ATT&CK profile, so the attribution is unconfirmed. Elastic states it is not clear who is behind the malware. The LATAM intrusion is the only observed deployment in the source; there is no reporting of BITSLOTH against financial services or against EMEA targets.

4. Mitigation & containment

P1 within 24 hours

• Hunt for the side-loading pair: flengine.dll in a ProgramData subdirectory alongside fl.exe. On any host where FL Studio is not a sanctioned application, treat the pair as malicious. Where FL Studio is sanctioned, verify the flengine.dll hash against the vendor-signed original.
• Hunt for main.txt files written by RINGQ and for processes loading shellcode from them. Alert on process-injection events where the call stack shows unbacked RWX regions between a signed loader and ntdll/kernelbase.
• Review BITS activity. BITSLOTH uses BITS for C2, so enumerate BITS jobs (Get-BitsTransfer -AllUsers in PowerShell) on servers and endpoints and investigate jobs with remote HTTP destinations that no administrator created.
• Block PsExec-style lateral movement between server segments where it is not operationally required, and alert on service creation consistent with PsExec.

P2 within 72 hours

• Restrict outbound HTTP from server segments to approved destinations. STOWAWAY proxies encrypted traffic over HTTP, so egress filtering with TLS inspection or destination allowlisting raises the cost of the tunnel.
• Add detection for IOX and STOWAWAY process names and command lines on endpoints and servers.
• Remove or block unsigned and non-approved copies of FL Studio across the estate; the side-load depends on a signed fl.exe being present and executable from a user-writable path.

P3 within 7 days

• Deploy the YARA and Sigma rules in §6 to EDR and SIEM.
• Add BITS job creation and modification to central logging if it is not already collected.
• Review whether keylogging and screen capture on server estates would be caught by existing controls; BITSLOTH's data-gathering handlers assume those capabilities are useful to the actor.

No vendor fix exists for BITSLOTH: it is malware, not a vulnerability, and no CVE or patch applies. Containment is detection and egress control.

5. Indicators of compromise

No network indicators (domains, IPs, URLs) and no file hashes are given in the source, so none are listed. The indicators above are single-sourced to Elastic Security Labs; verify before enforcement.

filepath  c:\programdata\pl studio\flengine.dll
filepath  c:\programdata\pl studio\fl.exe
filename  main.txt

Behavioural indicators

6. Detection

rule BITSLOTH_Sideload_FLStudio
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-26"
        reference = "https://www.elastic.co/security-labs/threat-command/bits-and-bytes-analyzing-bitsloth"
        description = "Detects BITSLOTH backdoor DLL side-loaded via FL Studio fl.exe, using the Simplified Chinese startup string and FL Studio engine name"
    strings:
        $s1 = "flengine.dll" wide ascii
        $s2 = "fl.exe" wide ascii
        $cn1 = { 已 经 有 一 个 程 序 在 运 行 } // "There is already a program running" (wide)
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

The Chinese string is written above as a placeholder for the wide-character byte sequence; substitute the exact UTF-16LE bytes from a confirmed sample before deployment, since the source gives the translation but not the raw bytes. The rule is deliberately loose (2 of 3) because the source does not publish the exact string bytes.

title: BITSLOTH FL Studio Side-Load
id: 8f2c1a4e-6b7d-4c9e-9a1f-3d5e7b2c4a10
status: experimental
description: Detects execution of FL Studio fl.exe loading flengine.dll from a ProgramData path, consistent with BITSLOTH side-loading
author: Adverse Trace
date: 2026-10-26
references:

    - https://www.elastic.co/security-labs/threat-command/bits-and-bytes-analyzing-bitsloth
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\fl.exe'
        ImageLoaded|endswith: '\flengine.dll'
        ImageLoaded|contains: '\ProgramData\'
    condition: selection
falsepositives:

    - Legitimate FL Studio installations in ProgramData on creative workstations
level: high

7. Sources

• Elastic Security Labs, "BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor", https://www.elastic.co/security-labs/threat-command/bits-and-bytes-analyzing-bitsloth, date not stated in the source.

8. Adverse Trace position

Adverse Trace assesses BITSLOTH as a capable data-gathering backdoor with a low-noise C2 channel (BITS) and a side-loading delivery that defeats hash and static-signature defences, but the entire assessment rests on one vendor report and the actor REF8747 has no MITRE ATT&CK profile, so attribution is unconfirmed and the tool's reach beyond the single LATAM government intrusion is unknown. No CVE or CISA KEV entry applies, so there is no patch deadline to enforce; the risk to EMEA financial services is that the same tradecraft (signed-binary side-loading, RINGQ-style shellcode loaders, STOWAWAY HTTP tunnelling, PsExec lateral movement) would run quietly on most estates. We will monitor for further reporting on BITSLOTH and REF8747, and we will reissue this advisory if a second source corroborates the indicators or if the tool is observed against financial-sector targets. Clients should run the P1 hunts in §4 this week and report back any hits for triage.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.