Threat reportMalwareTL-2026-3597
QuartzLine 'zenith' backdoor disguised as EV-signed PDF viewer
QuartzLine 'zenith' backdoor disguised as EV-signed PDF (TL-2026-3597), also tracked as QuartzLine, is a high-severity malware campaign, first published 2026-10-15 and last reviewed 2026-10-16. It has no confirmed attribution, affects Microsoft Windows, maps to 23 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 47 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 23MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 47Indicators of compromise
Key facts for TL-2026-3597
- Threat ID
- TL-2026-3597
- Also known as
- QuartzLine, zenith, win.cloudhaze
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 47
- Updates
- 2026-10-16 · revalidated 1× · latest source
Malware and tooling in QuartzLine 'zenith' backdoor disguised as EV-signed PDF
Malware and tooling: win.cloudhaze, zenith
How QuartzLine 'zenith' backdoor disguised as EV-signed PDF works
A Rust-written Windows backdoor ('zenith' module, implant v6.1.3) masquerades as a functional PDF viewer (paperline.exe / QuartzLine_1.x.exe) signed with a Sectigo EV code-signing certificate issued to Guangzhou Guoying Communication Technology Co., Ltd. It checks in to Cloudflare-fronted C2 over HTTPS with a custom obfuscated protocol and supports cmd /C execution and Chromium-family browser profile manipulation.
Rogue Authority (Squiblydoo) analyzed a Windows application presented as a PDF viewer under the names paperline.exe and QuartzLine_1.3177.99.exe / QuartzLine_1.9758.76.exe / QuartzLine_1.9740.56.exe. The binary is a 7.9 MB Rust executable using the Slint GUI framework with a working built-in PDF parser, so the visible application behaves legitimately while a hidden module named 'zenith' runs alongside it. The sample is signed with an EV code-signing certificate from Sectigo Public Code Signing CA EV R36 (serial 1b56cb4e99fb9444645a1ce7ffc0a46b, valid April 2026 to April 2027) issued to Guangzhou Guoying Communication Technology Co., Ltd., while the software claims to be 'Paperline Document Viewer' from 'Summit Works' - the signer entity is unrelated to the product. The certificate was later revoked (reason 'Privilege Withdrawn'), with the revocation backdated to issuance.
On launch the implant generates a machine UUID and persists it in %LOCALAPPDATA%\QuartzLine\terrain.dat (line format zenith=<uuid>). It then POSTs system information and the implant version (6.1.3; build ID QNPVXZGJYUSLTREHK; tag QZRT07) to /quarry/vein on its C2 domains (westbeavers.com, motherotters.com, healskills.com, the latter observed behind Cloudflare), followed by short status codes to /quarry/deposit. Additional configured but unobserved endpoints are /quarry/stratum, /quarry/gravel, /quarry/bedrock, /quarry/sandstone and /quarry/seam. No polling timer was found in code; the implant waits for server instructions. Requests carry no User-Agent header, which is atypical for desktop software.
C2 messages are JSON that is gzip-compressed, passed through a chained XOR (each byte XORed with the previous byte, fixed key, random seed), bit-rotated by a seed-dependent amount, Fisher-Yates shuffled using the seed, and Base64 encoded, all over HTTPS. The seed travels at the front of each message, so traffic can be decoded without server cooperation; the analyst decrypted 4 of 7 sandbox sessions. Observed server reply: {"lignite":{"update":false},"schist":{"success":true}}.
Supported capabilities are arbitrary command execution via cmd /C in a hidden window (returning exit code, execution time and output), and read/write/modification of Chromium-family browser profiles (Chrome, Edge and similar): the server supplies the target browser, profile path and files to modify, and the implant can force-close the browser and restart it with the modified profile. Arbitrary file read/write is also reported in the hunt skeleton summary. No live tasking was observed in sandbox runs, so the actual browser file targets, the update mechanism and the operator objective are unknown. Source paths are partly corrupted (mod.rs to mod.rn, main.rs to main.rj).
Attribution: no definitive actor or family attribution is made. KesaKode matched 54% to GeckoStealer, mainly through shared Rust library code. Malpedia associates the report with the family win.cloudhaze. Severity is an analyst estimate; no CVE or CVSS applies.
MITRE ATT&CK techniques used in TL-2026-3597
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 Indicator Removal; T1564.003 Hidden Window
Persistence
Execution
T1059.001 Command and Scripting Interpreter; T1059.003 Windows Command Shell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1217 Browser Information Discovery
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Password Stores
defense-impairment
Exfiltration
T1567.002 Exfiltration Over Web Service
Resource Development
T1583.001 Domains; T1583.008 Acquire Infrastructure; T1588.003 Code Signing Certificates; T1608.001 Stage Capabilities
Affected products and versions in QuartzLine 'zenith' backdoor disguised as EV-signed PDF
- Microsoft — Windows
Vulnerable versions: Windows systems that run the trojanized QuartzLine / Paperline viewer (implant v6.1.3)
Remediation for QuartzLine 'zenith' backdoor disguised as EV-signed PDF
Immediate actions
- Block westbeavers.com, motherotters.com and healskills.com at DNS and web proxy
- Hunt for %LOCALAPPDATA%\QuartzLine\terrain.dat and 'zenith=' strings on endpoints
- Hunt for SHA256 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3 and the filenames paperline.exe / QuartzLine_1.*.exe
- Block or alert on the code-signing certificate serial 1b56cb4e99fb9444645a1ce7ffc0a46b
- Isolate affected hosts and reset credentials/sessions stored in Chromium-family browser profiles on those hosts
Workarounds
- Restrict installation of unmanaged PDF viewers; standardize on an approved viewer
Longer-term hardening
- Do not treat a valid EV signature alone as proof of legitimacy; add publisher allow-listing and application control
- Alert on HTTPS POSTs to /quarry/vein or /quarry/deposit and on outbound HTTP clients that send no User-Agent header
- Alert on a document-viewer process spawning cmd.exe /C
- Alert on non-browser processes running taskkill /F against browsers followed by a browser restart with --user-data-dir
Timeline of QuartzLine 'zenith' backdoor disguised as EV-signed PDF
- Sectigo EV code-signing certificate (serial 1b56cb4e99fb9444645a1ce7ffc0a46b) issued to Guangzhou Guoying Communication Technology Co., Ltd., valid April 2026 to April 2027 (source gives month only; day approximated)
- First sandbox/triage captures of the QuartzLine sample observed (September 16-17, 2026)
- Additional triage captures; sandbox sessions of about 10 minutes showed check-in to /quarry/vein and /quarry/deposit but no live tasking
- Expel-observed victim downloads the QuartzLine installer from an AWS S3 bucket after a Google Ads malvertising redirect; the installer creates the QuartzlineUpdateCheck task and begins C2 check-ins.
- Operator deploys chrome-history-summarizer-v0.0.1.exe, which uploads Chrome history, passwords, cookies and session tokens to the chrome-history-backup S3 bucket.
- Signing certificate revoked by the CA with reason 'Privilege Withdrawn' (October 2026, month precision; revocation date backdated to issuance)
- quartzline_takeover_carrier.exe lands on the host and self-deletes within seconds.
- replaceInPlace.ps1 swaps quartzline.exe for a newer build (also distributed as fielddesk.exe); Expel observes the push across multiple customers.
- Rogue Authority (Squiblydoo) publishes technical analysis of the QuartzLine 'zenith' backdoor; Malpedia library entry links it to win.cloudhaze
- Further triage capture and ANY.RUN submission tested on October 9, 2026
- deployApp.ps1 drops the second-stage RAT caira.exe with the CairaServiceCheck scheduled task.
- A host resolves three new C2 domains; the IronBark third-stage payload is confirmed in a separate environment.
- Expel publishes its QuartzLine analysis; Mandiant tracks the malware as CLOUDHAZE.
Update history for TL-2026-3597
- 2026-10-16 — QuartzLine (CLOUDHAZE): Trojanized Windows PDF Viewer Backdoor Spread via Malvertising: What changed No field escalation. Severity stays HIGH and exploitability stays ACTIVE, both already at the level the evidence supports. The intelligence is materially extended: the existing record's open questions (actual tasking, update me
Sources cited for QuartzLine 'zenith' backdoor disguised as EV-signed PDF
- A signed PDF viewer that quietly takes orders: the QuartzLine 'zenith' backdoor
- Malpedia library entry (win.cloudhaze)
- BeaconBeagle config search for westbeavers.com (no matches)
- MITRE ATT&CK T1553.002 Subvert Trust Controls: Code Signing
- MITRE ATT&CK T1588.003 Obtain Capabilities: Code Signing Certificates
Detection coverage for TL-2026-3597
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3597 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.