# Covert Backdoor / Surveillance Implant via Software Update

- **Severity:** Critical
- **Signature ID:** `8ad4ccda-ce6e-47b0-828a-fdf802a0dce2`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI02 (Tool Misuse and Exploitation), ASI03 (Identity and Impersonation), LLM01 (Prompt Injection), LLM08 (Vector and Embedding Weaknesses)

## Summary

This rule flags attempts to trick an AI agent that has update or maintenance tools into using a normal patch cycle as cover for something malicious: planting a backdoor, installing surveillance software, or stealing admin credentials. The trigger is the combination of update language with a covert or credential-theft goal, not the update process itself.

## How the attack works

An attacker sends the agent an instruction framed as maintenance work, such as applying a software update or running a scheduled patch. Hidden inside that instruction is a second objective: implant a persistent backdoor that survives the update, install covert monitoring tools, or run a phishing step to capture administrator credentials. Because the agent has legitimate update or maintenance tooling, it can carry out the malicious payload using access it was already trusted with. The rule watches for this pairing of ordinary update wording with an explicit persistence, surveillance, or credential-theft verb.

## Why it matters

If successful, an attacker gains persistent remote access or administrator credentials on systems the agent maintains, disguised as routine patching activity that is unlikely to draw scrutiny.

## What you can do

- Require a human to review and approve any instruction that combines update/maintenance actions with credential access or new remote-access configuration.
- Log and diff what an update actually changes on a system so unauthorized additions like backdoors or monitoring tools are visible.
- Restrict which agents or tool calls can both apply updates and touch credential stores or remote-access settings.
- Treat 'apply the authorized security update' as normal, but flag any update instruction that also mentions covert access, surveillance, or credential harvesting for manual review.

## Known benign look-alikes

- Legitimate patching language ('apply the authorized security update', 'install the signed vendor patch') that does not pair the update with a covert-persistence or credential-theft objective.
- Defensive directives to scan for or remove backdoors / surveillance tooling.
- Security research corpora cataloguing ASB attack strings as reference samples — should be allowlisted by a reviewer.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01802

---
Source: https://www.netzilo.com/threats/atr-covert-backdoor-surveillance-implant-via-software-update