Stella_Gary Modular C# Backdoor Framework (Kimsuky)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•3

This rule identifies the Stella_Gary modular C# backdoor framework, which has been attributed to the Kimsuky (APT-C-55) threat group. The rule functions by detecting specific naming conventions within the binary and the presence of .NET assembly loading capabilities combined with plugin management functionality, characteristic of this modular malware family.