Trochilus

Trochilus is an open-source Windows remote access trojan written in C++ that has been publicly available since at least 2015 and has been repeatedly reused, modified, or incorporated by multiple China-aligned intrusion sets. It functions as a backdoor/RAT framework and has served both as a directly deployed implant and as source material for derivative malware including RedLeaves and SprySOCKS. Security reporting has also linked customized Trochilus variants to activity by groups such as Webworm, APT31, and clusters overlapping with Earth Lusca or FishMonger through downstream tooling derived from its codebase.

On Windows, Trochilus and modified variants have been observed using multi-stage loader chains, DLL sideloading, in-memory unpacking, and process injection into legitimate processes such as svchost.exe to establish covert remote access. Documented capabilities include remote command execution, file download and upload, execution of additional payloads, system and process interaction, and use as a general-purpose foothold for follow-on operations. Customized deployments have also incorporated privilege-related tradecraft such as token theft and UAC bypass in surrounding loader stages.

Trochilus has been used in espionage-oriented campaigns targeting government and enterprise victims, including sectors such as IT services, aerospace, electric power, telecommunications, and think tanks across Asia and other regions. Its long-term operational significance stems less from a single canonical campaign than from its role as a widely reused malware codebase within the Chinese threat ecosystem, where actors have adapted it into purpose-built backdoors and cross-platform successors.