Loading threat actor…
LuoYu is a China-origin, PRC-linked advanced persistent threat group associated with cyberespionage. Its toolset includes WinDealer, ReverseWindow, XDealer, ShadowPad, and PlugX. XDealer, also known as DinodasRAT, is a cross-platform backdoor that has also been used by other China-linked actors; shared use does not establish that those actors are aliases or subgroups of LuoYu. LuoYu employs adversary-in-the-middle techniques, including software-update hijacking, to facilitate malware delivery. It also leverages compromised small-office/home-office devices as proxy infrastructure, helping conceal attack traffic and its operational origins. ReverseWindow samples associated with LuoYu have communicated with infrastructure also identified as ShadowPad command-and-control servers. The combination of custom backdoors, shared modular malware platforms, network interception, and compromised proxy devices characterizes its espionage-oriented intrusion activity.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
7 malware families Mallory has associated with this actor across public reporting.
2 additional families tracked in Mallory.
2 indicators attributed to this actor. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.