ABCDoor Backdoor Execution Masquerading As Tailscale

Tim Peck@timpeck

•updated Apr 30, 2026•2•0•135

Detects the execution of a Python interpreter (pythonw.exe) running the 'appclient' module from within the C:\ProgramData\Tailscale directory. This technique is used by the Silver Fox APT group to deploy the ABCDoor backdoor while masquerading as legitimate VPN software to evade detection.