Loading malware…
HealthKick is a custom Windows backdoor/backdoor family first observed in April 2025 and associated with China-aligned spear-phishing activity. Reporting links it to the threat clusters UNK_DropPitch and UTA0388, and Volexity characterizes it as an early C++ variant and predecessor of the GOVERSHELL malware family. Proofpoint tracks the malware as HealthKick, while Volexity tracks the same or related malware as an early GOVERSHELL variant.
Observed delivery relied on spear-phishing emails, including campaigns impersonating fictitious investment firms and other tailored personas. Victims were directed to malicious ZIP or RAR archives containing a legitimate executable and a malicious DLL; execution of the executable triggered DLL sideloading/search-order hijacking to load the backdoor. Campaigns targeted organizations and individuals in North America, Asia, and Europe, including large investment banks and financial analysts focused on Taiwan’s semiconductor and technology sectors. Citizen Lab also reported HealthKick delivery against civil society and journalist-related targets in activity aligned with broader China-linked targeting.
HealthKick is described as capable of executing commands, capturing command output, and exfiltrating results to a command-and-control server. The earliest variant could run commands via cmd.exe. Proofpoint reported persistence via a scheduled task named SystemHealthMonitor configured to run every five minutes. Network communications included a WebSocket connection to 82.118.16[.]72 over TCP port 465 using a FakeTLS protocol; payloads were XOR-encoded with the key "mysecretkey." Related reporting also describes fake TLS/TCP 465 communications for this malware family. High-confidence infrastructure and behavioral details directly mentioned in the content include the C2 IP 82.118.16[.]72, TCP port 465, the scheduled task name SystemHealthMonitor, and use of DLL sideloading/search-order hijacking for execution.
Aliases and naming overlap in the source material indicate that HealthKick is also referred to as an early GOVERSHELL variant, but HealthKick is the commonly used name for the specific backdoor described in the phishing campaigns.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
GOVERSHELL: All implants were DLL files that were loaded via search order hijacking from the legitimate version of either the 32- or 64-bit version of an open-source project. ... GOVERSHELL is a stealthy Windows implant that communicates over HTTPS with a remote command and control server.
Volexity tracks the deployed payload as GOVERSHELL and has observed five distinct variants of this malware family.
Volexity tracks the deployed payload as GOVERSHELL and has observed five distinct variants of this malware family.
If the downloaded file was opened and executed, the user’s device would be infected with a custom backdoor. The backdoor is tracked by the security vendor Proofpoint as “HealthKick,” and by the security vendor Volexity as an early variant of “GOVERSHELL.”
23 distinct techniques documented for this family, organized by ATT&CK tactic.
"exploiting two then-zero-day security flaws in Cisco ISE and Citrix NetScaler"; "WSUS... RCE"; "Cisco IOS XE... CVE-2023-20198"; "SharePoint ToolShell"; "VMware Tools... exploited as a zero-day"
The disclosure comes as the Citizen Lab flagged a new phishing campaign undertaken by two distinct China-affiliated threat actors targeting and impersonating journalists and civil society...
Chinese state-aligned hackers have ramped up espionage efforts against Taiwan's semiconductor ecosystem through spear-phishing campaigns... UNK_FistBump used job-themed lures, posing as graduate students applying for positions. The attackers sent phishing emails from compromised Taiwanese university email accounts to HR and recruiting teams at semiconductor companies. Attached documents led to malware-laced ZIP or PDF files hosted on file-sharing platforms such as Zendesk and Filemail.
Silent Chollima primary and sole method for targeting organizations is by conducting spear phishing campaigns. Between June and August 2025, Silent Chollima sent phishing emails containing HTML that included an image to make it appear a document was attached to the email. If the image were clicked, it led to the download of a remotely hosted archive file.
Each variant of GOVERSHELL sets up persistence via a scheduled task on its first execution... This function creates a hidden scheduled task named "SystemHealthMonitor" using schtasks.exe... every 5 minutes at highest privileges.
PowerShell commands are properly escaped and run silently using powershell.exe -NoProfile -NonInteractive -Command, with full stdout/stderr capture.
When a command is received, it is first XOR decrypted, then checked for the "EP" prefix to determine if it should be executed via PowerShell or cmd.exe.
“Execution of the… LNK file… runs a VBS script… [and] opens a decoy document…” / “Upon execution… scheduled task… created…”
Users would then need to open and execute the executable file within the archive in order to become infected.
When executed, this legitimate executable would load a malicious payload in an included Dynamic Link Library (DLL), via search order hijacking which provided operators with the ability to remotely execute commands on infected devices.
Each variant of GOVERSHELL sets up persistence via a scheduled task on its first execution... This function creates a hidden scheduled task named "SystemHealthMonitor" using schtasks.exe... every 5 minutes at highest privileges.
Each variant of GOVERSHELL sets up persistence via a scheduled task on its first execution... This function creates a hidden scheduled task named "SystemHealthMonitor" using schtasks.exe... every 5 minutes at highest privileges.
All network traffic, including check ins, task retrieval, and results, is protected using XOR encryption (key: 11) combined with Base64 encoding before transmission.
“...decrypts the RC4-encrypted Cobalt Strike Beacon payload from the rc4.log file using the key qwxsfvdtv…” / “...Base64-encoded and RC4-encrypted… using… CiscoCollabHost.exe as the RC4 key…” / “...payload which is XOR encoded with the key mysecretkey.”
When executed, this legitimate executable would load a malicious payload in an included Dynamic Link Library (DLL), via search order hijacking which provided operators with the ability to remotely execute commands on infected devices.
sysinfo Retrieve the following information about the victim’s machine: OS, CPU Architecture, Number of CPU cores, Hostname
GOVERSHELL Variant 4 (WebSocket)... The malware connects to the C2 over WebSocket and communicates with the C2 using JSON encoded data...
GOVERSHELL is a stealthy Windows implant that communicates over HTTPS with a remote command and control server.
“...communicates with… C2 IP address 166.88.61[.]35 over… 443.” / “...web socket to… 82.118.16[.]72…” / “...reverse shell… 45.141.139[.]222…”
The attackers impersonated fictitious investment firms and sent malicious ZIP files containing vulnerable executables and DLLs, resulting in the delivery of backdoors such as HealthKick or a simple raw TCP reverse shell. The malware communicated with C2 servers over TCP port 465 using FakeTLS and XOR encryption.
If the image were clicked, it led to the download of a remotely hosted archive file.
It uses XOR encryption combined with Base64 to protect all network traffic and payloads from casual inspection.
...provided operators with the ability to remotely execute commands on infected devices.
“...create a web socket to… 82.118.16[.]72 over TCP port 465.” / “...reverse shell… 45.141.139[.]222 again over TCP port 465”
“HealthKick employs a FakeTLS protocol and expects a response… starting with… TLSv1.2… This… followed by a payload which is XOR encoded…”
The malware communicated with C2 servers over TCP port 465 using FakeTLS and XOR encryption.
29 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.