APT Naikon BackdoorDiplomacy Loader Unpacking Routine

Tim Peck@timpeck

•updated Sep 24, 2025•2•0•94

Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.