Resident

Resident is a backdoor malware family associated with TA866 (also known as Asylum Ambuscade). Cisco Talos reporting describes it as a backdoor used in limited post-compromise cases to download and execute additional payloads on victim systems. TA866 activity linked to Resident has been observed following initial access via malspam and malvertising, including campaigns using email thread hijacking, malicious hyperlinks, attached PDF or Microsoft Publisher files, malicious Google ads, SEO poisoning, and 404 TDS infrastructure. In one observed case, TA866 used certutil to retrieve the Resident backdoor from hxxps://temp[.]sh/esuJB/resident[.]exe and save it as C:\programdata\res.exe. Talos also noted that TA866 frequently used file-hosting services such as temp[.]sh for payload delivery.

Resident is linked by Cisco Talos to the same threat actor assessed to have developed WarmCookie/BadSpace. Reported overlaps between Resident and WarmCookie include identical RC4 decryption implementations, similar mutex management using GUID-like mutex strings, and similar persistence mechanisms, indicating likely shared authorship associated with TA866.

Resident has been observed in intrusion activity affecting victims primarily in the United States, with additional cases in Canada, the United Kingdom, Germany, Italy, Austria, and the Netherlands. The most affected sector reported for TA866 follow-on payload cases was manufacturing, followed by government and financial services.