Skip to main content
Mallory
11 malware familiesExploits CVEs in the wild

BackdoorDiplomacy

Also known asBackdoorDiplomacy

BackdoorDiplomacy is a Chinese threat actor associated with cyberespionage activity. Reporting in the provided content describes it as a Chinese state-sponsored or Chinese-aligned actor, with overlap or a close relationship noted with APT15 and additional overlap reported with Playful Taurus, Vixen Panda, NICKEL, and Ke3chang. Sophos also identified overlap between activity in its Crimson Palace Cluster Alpha and prior reporting on BackdoorDiplomacy. The group has targeted government entities as well as high-priority telecommunications and finance organizations. The content specifically notes operations across Africa for several years, including targeting linked to South Africa, Kenya, Senegal, and Ethiopia, as well as activity in the Middle East. Recent reporting cited in the content describes a sustained three-year campaign against governmental organizations in Kenya. Tradecraft described in the content includes exploitation of public-facing applications and misconfigurations for initial access, including CVE-2020-5902 in F5 BIG-IP to drop a Linux backdoor and exploitation of misconfigured Plesk servers. The content also associates BackdoorDiplomacy with web shell and IIS-component-related persistence, command and scripting interpreter use, and malware/tool upload activity in ATT&CK annotations. Operational behaviors mentioned include obtaining and using leaked malware such as DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy; using SMBTouch to determine whether targets were vulnerable to EternalBlue; obtaining open-source reconnaissance and red-team tools for discovery and lateral movement; obfuscating tools and malware with VMProtect; dropping implants in folders named for legitimate software; copying files of interest to the main drive's Recycle Bin for staging; and using an executable to detect removable media such as USB flash drives. The content also notes a sideloading chain resembling one used to deploy a Merlin Agent by BackdoorDiplomacy.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

41 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

11 of 15 tactics55 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0042
Resource Development
2 techniques
T1588
Obtain Capabilities
T1588.001
Malware
T1588.002×3
Tool
T1608
Stage Capabilities
T1608.001
Upload Malware
T1608.002
Upload Tool
TA0001
Initial Access
2 techniques
T1133×5
External Remote Services
T1190×24
Exploit Public-Facing Application
TA0002
Execution
3 techniques
T1059×3
Command and Scripting Interpreter
T1059.003
Windows Command Shell
T1569
System Services
T1569.002
Service Execution
T1574
Hijack Execution Flow
T1574.001×4
DLL
T1574.011
Services Registry Permissions Weakness
TA0003
Persistence
2 techniques
T1133×5
External Remote Services
T1505
Server Software Component
T1505.003×5
Web Shell
T1505.004
IIS Components
TA0005
Stealth
5 techniques
T1027×4
Obfuscated Files or Information
T1027.002×2
Software Packing
T1036
Masquerading
T1036.005
Match Legitimate Resource Name or Location
T1070
Indicator Removal
T1070.004
File Deletion
T1574
Hijack Execution Flow
T1574.001×4
DLL
T1574.011
Services Registry Permissions Weakness
T1620
Reflective Code Loading
TA0006
Credential Access
1 technique
T1003
OS Credential Dumping
T1003.003
NTDS
TA0007
Discovery
7 techniques
T1016
System Network Configuration Discovery
T1018×2
Remote System Discovery
T1046×6
Network Service Discovery
T1082×2
System Information Discovery
T1083
File and Directory Discovery
T1087
Account Discovery
T1087.002
Domain Account
T1120×2
Peripheral Device Discovery
TA0008
Lateral Movement
2 techniques
T1021
Remote Services
T1021.003
Distributed Component Object Model
T1550
Use Alternate Authentication Material
T1550.002
Pass the Hash
TA0009
Collection
4 techniques
T1005×2
Data from Local System
T1074
Data Staged
T1113
Screen Capture
T1560
Archive Collected Data
TA0011
Command and Control
5 techniques
T1071
Application Layer Protocol
T1071.001×2
Web Protocols
T1090
Proxy
T1105×8
Ingress Tool Transfer
T1572
Protocol Tunneling
T1573
Encrypted Channel
T1573.002
Asymmetric Cryptography
TA0010
Exfiltration
1 technique
T1041
Exfiltration Over C2 Channel
WEAPONIZED

Associated vulnerabilities

9 CVEs this actor has used in observed campaigns. 9 of them exploited in the wild.

CVE-2020-5902F5 BIG-IP TMUI Remote Code ExecutionIn the wildEvidence2

BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.

CVE-2021-31207Post-auth Arbitrary File Write in Microsoft Exchange Server (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34473ProxyShell Autodiscover SSRF in Microsoft Exchange ServerIn the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34523Microsoft Exchange PowerShell Backend Elevation of Privilege (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2022-26134Atlassian Confluence Server and Data Center OGNL Injection RCEIn the wildEvidence1

The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence... This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise.

4 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping41

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal11

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs9

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables19

Domains, IPs, and hashes tied to this actor, refreshed continuously.