Loading threat actor…
Dalbit is a China-based intrusion set associated with espionage and financially motivated intrusions against enterprise environments, with a strong concentration on South Korean organizations. The group has been observed targeting vulnerable internet-facing servers, particularly Windows web servers, and has also compromised mail servers and Microsoft SQL servers. Reported victimology includes at least dozens of South Korean companies since 2022, including semiconductor manufacturing, technology, and chemical-sector organizations. Dalbit commonly relies on exploitation of known vulnerabilities and file-upload weaknesses for initial access, including deployment of JSP web shells on exposed application servers. Post-compromise activity includes credential theft through LSASS dumping, internal reconnaissance with network scanning tools, lateral movement using Impacket, and use of proxy and tunneling utilities such as FRP and Venom. The group has also used publicly available offensive frameworks and tools including Cobalt Strike, Metasploit, Ladon, and the cross-platform BlueShell backdoor. BlueShell use linked to Dalbit demonstrates the group’s ability to operate across Windows and Linux environments and to blend open-source malware with customized tooling. Observed tradecraft includes obfuscated and customized FRP components, encrypted configuration handling in memory, remote shell execution, file transfer, and proxying. Dalbit has also been linked through broader clustering to activity tracked as UAT-5918, which has been associated with China-linked operational relay box and stealth infrastructure operations. Overall, Dalbit is best characterized as a China-nexus threat actor focused on server exploitation, credential access, lateral movement, persistence, and data theft, with some operations also involving system encryption and ransom demands.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Dalbit is a China-nexus threat actor targeting South Korean companies in the semiconductor, technology, and chemical sectors, likely for IP theft.
China-based threat group targeting vulnerable servers to steal internal corporate data or encrypt systems for financial gain. In the described cases it used public offensive tools and was associated with BlueShell during attacks on Windows web servers and related infrastructure.
Named activity cluster referenced as linked (by Cisco Talos) to UAT-5918 activity associated with the LapDogs ORB campaign.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.