Loading threat actor…
REF5961 is a China-nexus, state-sponsored cyberespionage intrusion set associated with long-term operations against government targets in Southeast Asia, including the foreign affairs ministry of an ASEAN member state. The activity has been linked to espionage objectives focused on sustained access, reconnaissance, credential collection, lateral movement, persistence, and exfiltration of sensitive political, military, technical, and infrastructure-related information. Reporting also links related activity to Mongolia-focused targeting. REF5961 has been associated with the malware families EAGERBEE, RUDEBIRD, DOWNTOWN (also referred to as PhantomNet in related reporting), and BLOODALCHEMY. EAGERBEE is a Windows backdoor capable of forward and reverse command-and-control, proxy-aware communications, optional SSL, and in-memory execution of downloaded payloads. RUDEBIRD is a lightweight HTTPS backdoor used for reconnaissance, code execution, and lateral movement. DOWNTOWN is a modular plugin-based implant aligned with SManager/PhantomNet tradecraft. BLOODALCHEMY is an x86 backdoor discovered as injected shellcode and assessed to be under active development; it supports multiple persistence mechanisms, several execution modes, process injection, and communications over HTTP, named pipes, and sockets. Observed tradecraft includes extensive DLL sideloading, use of signed or legitimate binaries as loaders, service-based persistence, scheduled tasks, registry-based autoruns, COM-based persistence, process injection, dynamic API resolution, anti-analysis measures, proxy awareness, and evasive infrastructure management. Related campaign reporting tied overlapping activity to multiple intrusion clusters operating with shared objectives and partially shared tooling, credentials, infrastructure patterns, and victimology. Public overlap has been noted with clusters and malware associated with LuckyMouse/APT27/Emissary Panda, TA428, BackdoorDiplomacy, Worok, and other Chinese espionage reporting, but the most defensible characterization is REF5961 as a China-nexus espionage intrusion set rather than a conclusively unified public actor identity. The actor’s dominant pattern is strategic intelligence collection against government entities, especially in Southern and Southeastern Asia, with emphasis on maintaining redundant access and evolving malware capability over time.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
18 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese-nexus espionage actor referenced because Cluster Alpha overlaps in malware and C2 infrastructure, including use of EAGERBEE, RUDEBIRD, and PhantomNet/DOWNTOWN against a Southeast Asian foreign affairs target.
Chinese-nexus intrusion set referenced for overlap with Cluster Alpha through shared malware families and C2 infrastructure, previously reported targeting an ASEAN member’s foreign affairs ministry.
Intrusion set associated with the BLOODALCHEMY backdoor, which uses DLL sideloading, shellcode injection, multiple persistence mechanisms, and several communication options. The tooling appears modular and still in active development.
State-sponsored, espionage-motivated intrusion set targeting governments and multinational government organizations in Southern and Southeastern Asia, including an ASEAN foreign affairs ministry environment. Associated with new malware families EAGERBEE, RUDEBIRD, and DOWNTOWN, and assessed as a China-nexus actor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.