# QuartzLine 'zenith' backdoor disguised as EV-signed PDF viewer

> A Rust-written Windows backdoor ('zenith' module, implant v6.1.3) masquerades as a functional PDF viewer (paperline.exe / QuartzLine_1.x.exe) signed with a Sectigo EV code-signing certificate issued to Guangzhou Guoying Communication Technology Co., Ltd. It checks in to Cloudflare-fronted C2 over HTTPS with a custom obfuscated protocol and supports cmd /C execution and Chromium-family browser profile manipulation.

- **Published:** 2026-10-15T08:40:35Z
- **Last reviewed:** 2026-10-16T00:30:39.181Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3597
- **ID:** TL-2026-3597
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Rogue Authority (Squiblydoo) analyzed a Windows application presented as a PDF viewer under the names paperline.exe and QuartzLine_1.3177.99.exe / QuartzLine_1.9758.76.exe / QuartzLine_1.9740.56.exe. The binary is a 7.9 MB Rust executable using the Slint GUI framework with a working built-in PDF parser, so the visible application behaves legitimately while a hidden module named 'zenith' runs alongside it. The sample is signed with an EV code-signing certificate from Sectigo Public Code Signing CA EV R36 (serial 1b56cb4e99fb9444645a1ce7ffc0a46b, valid April 2026 to April 2027) issued to Guangzhou Guoying Communication Technology Co., Ltd., while the software claims to be 'Paperline Document Viewer' from 'Summit Works' - the signer entity is unrelated to the product. The certificate was later revoked (reason 'Privilege Withdrawn'), with the revocation backdated to issuance.

On launch the implant generates a machine UUID and persists it in %LOCALAPPDATA%\QuartzLine\terrain.dat (line format zenith=<uuid>). It then POSTs system information and the implant version (6.1.3; build ID QNPVXZGJYUSLTREHK; tag QZRT07) to /quarry/vein on its C2 domains (westbeavers.com, motherotters.com, healskills.com, the latter observed behind Cloudflare), followed by short status codes to /quarry/deposit. Additional configured but unobserved endpoints are /quarry/stratum, /quarry/gravel, /quarry/bedrock, /quarry/sandstone and /quarry/seam. No polling timer was found in code; the implant waits for server instructions. Requests carry no User-Agent header, which is atypical for desktop software.

C2 messages are JSON that is gzip-compressed, passed through a chained XOR (each byte XORed with the previous byte, fixed key, random seed), bit-rotated by a seed-dependent amount, Fisher-Yates shuffled using the seed, and Base64 encoded, all over HTTPS. The seed travels at the front of each message, so traffic can be decoded without server cooperation; the analyst decrypted 4 of 7 sandbox sessions. Observed server reply: {"lignite":{"update":false},"schist":{"success":true}}.

Supported capabilities are arbitrary command execution via cmd /C in a hidden window (returning exit code, execution time and output), and read/write/modification of Chromium-family browser profiles (Chrome, Edge and similar): the server supplies the target browser, profile path and files to modify, and the implant can force-close the browser and restart it with the modified profile. Arbitrary file read/write is also reported in the hunt skeleton summary. No live tasking was observed in sandbox runs, so the actual browser file targets, the update mechanism and the operator objective are unknown. Source paths are partly corrupted (mod.rs to mod.rn, main.rs to main.rj).

Attribution: no definitive actor or family attribution is made. KesaKode matched 54% to GeckoStealer, mainly through shared Rust library code. Malpedia associates the report with the family win.cloudhaze. Severity is an analyst estimate; no CVE or CVSS applies.

## MITRE ATT&CK

- T1588.003 Code Signing Certificates
- T1583.001 Domains
- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1036 Masquerading
- T1553.002 Code Signing
- T1564.003 Hidden Window
- T1027 Obfuscated Files or Information
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1573 Encrypted Channel
- T1082 System Information Discovery
- T1005 Data from Local System
- T1583.008 Acquire Infrastructure
- T1608.001 Stage Capabilities
- T1059.001 Command and Scripting Interpreter
- T1053.005 Scheduled Task/Job
- T1070.004 Indicator Removal
- T1555.003 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1217 Browser Information Discovery
- T1105 Ingress Tool Transfer
- T1567.002 Exfiltration Over Web Service

## Sources

- [A signed PDF viewer that quietly takes orders: the QuartzLine 'zenith' backdoor](https://rogueauthority.org/quartzline-signed-pdf-viewer-zenith-backdoor)
- [Malpedia library entry (win.cloudhaze)](https://malpedia.caad.fkie.fraunhofer.de/library/afde8b90-cd43-4b93-b251-de2a74382f18/)
- [BeaconBeagle config search for westbeavers.com (no matches)](https://beaconbeagle.com/api/v1/configs/search?domain=westbeavers.com)
- [MITRE ATT&CK T1553.002 Subvert Trust Controls: Code Signing](https://attack.mitre.org/techniques/T1553/002/)
- [MITRE ATT&CK T1588.003 Obtain Capabilities: Code Signing Certificates](https://attack.mitre.org/techniques/T1588/003/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3597