sesameop

SesameOp is the name assigned to a backdoor associated with a previously unknown advanced persistent threat conducting long-term cyber espionage. The operation is notable for abusing the OpenAI Assistants API as a covert command-and-control channel, allowing malicious traffic to blend with legitimate cloud and AI service usage. This reflects a broader tradecraft pattern in which threat actors hide C2 activity behind trusted third-party infrastructure. Observed tradecraft indicates use of spear-phishing as the predominant intrusion vector in the broader campaign environment, with government and military entities as the principal target classes. The malware reportedly employed a trojanized DLL loader and .NET AppDomainManager injection to establish execution and persistence, and used a specialized injection technique to support stealthy post-compromise operations. The actor’s use of legitimate AI infrastructure for C2 represents an uncommon but significant evolution in defense-evasion and post-exploitation methods. At high confidence, SesameOp is linked to espionage activity rather than financially motivated crime or ransomware. Publicly available reporting in this context does not attribute the operator to a specific named threat group or nation state, and no corroborated sub-group structure or additional aliases are established beyond the malware name itself.