ScanBox
ScanBox is a PHP- and JavaScript-based web reconnaissance and exploitation framework, publicly documented since at least 2014, that is primarily used pre-compromise for victim profiling and in some cases exploit delivery. The content describes it as a custom exploit kit/host profiler and JavaScript keylogger that supports fileless targeting through browser-delivered scripts. Reported capabilities include browser and system profiling; collection of URL, referrer, title, domain, user-agent, cookies, character encoding, screen dimensions, operating system, language, color depth, Flash version, browser plugins, Java/ActiveX presence, and other fingerprinting data; keystroke capture; cookie theft; iframe creation; plugin execution; and, in one 2022 campaign, a peer-connection module using WebRTC/STUN and a security-check module looking for Kaspersky Internet Security artifacts. Server-side paths observed for data handling and plugin loading included /i/v.php, /i/c.php, /i/k.php, and /i/p.php.
The framework has been repeatedly associated with Chinese espionage activity and is assessed in the content as likely privately shared among multiple China-based threat actors. Threat actors and clusters explicitly linked to ScanBox usage in the content include APT3, Threat Group-3390/LuckyMouse/Emissary Panda/APT27/Iron Tiger, TA423/Red Ladon/APT40/Leviathan/GADOLINIUM, TA413, Earth Empusa/POISON CARP/Evil Eye, and BRONZE MOHAWK. Reported targeting includes Australian federal and local government agencies, Australian media organizations, Malaysian entities, heavy industry and energy-related organizations tied to South China Sea and Taiwan Strait projects, Japanese government and high-tech organizations, Tibetan organizations and the Tibetan exile community, Uyghur- and Tibet-related targets, Turkish and Taiwanese sites, and a national data center and government websites in a Central Asian country.
Observed delivery and infection vectors include phishing emails linking to malicious websites, fake news portals, fake Adobe Flash update pages, watering-hole compromises of government and NGO websites, and malicious JavaScript injected into Cisco ASA Clientless SSL VPN login portals. In multiple cases, victims visiting compromised or spoofed sites were redirected to pages hosting ScanBox and sometimes BEeF. One campaign used australianmorningnews[.]com and image[.]australianmorningnews[.]com to deliver ScanBox; another involved Cisco Web VPN pages loading ScanBox-related JavaScript via accounts.nttdocomo.mailsecure.cc; other reporting cited redirects to update.iaacstudio[.]com and exploit-related URLs such as https://103.42.181.84/2/css.js and http://webxss.cn/mu5AOh?1440094244. A SHA-256 hash reported for one ScanBox sample is 7795936ed1bdb7a5756c1ff821b2dc8739966abbb00e3e0ae114ee728bf1cf1a.
The content also notes ScanBox has been used alongside or in proximity to other tooling including BEeF, HyperBro, Cobalt Strike, Meterpreter, and Derusbi in broader intrusion chains. High-confidence behavior directly described in the sources is reconnaissance, profiling, keylogging, and support for exploitation or follow-on compromise rather than standalone persistence on the endpoint.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"The JavaScript in these attacks links back to a JavaScript profiling and exploitation framework called Scanbox."
Groups observed using it
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Upon continued investigation in late April 2020, we found another phishing page that appears to be copied from a third-party web store and injected with two scripts to load ScanBox and BeEF frameworks.
Tools Nanhaishu, Orz, SeDll, Cobalt Strike, GreenCrash, AIRBREAK, BlackCoffee, China Chopper, FUSIONBLAZE, HOMEFRY, MURKYTOP, Metasploit / Meterpreter, ScanBox, Derusbi Trojan, Derusbi, Metasploit
"...or the ScanBox reconnaissance framework, which perform the same tasks as a keylogger."
"The JavaScript in these attacks links back to a JavaScript profiling and exploitation framework called Scanbox."
"...redirected users to malicious sites hosting exploitation tools such as ScanBox and BEeF (Browser Exploitation Framework)."
Proofpoint and PwC Threat Intelligence have jointly identified a cyber espionage campaign, active since April 2022 through June, delivering the ScanBox exploitation framework to targets who visit a malicious domain posing as an Australian news website.
Proofpoint and PwC Threat Intelligence have jointly identified a cyber espionage campaign, active since April 2022 through June, delivering the ScanBox exploitation framework to targets who visit a malicious domain posing as an Australian news website.
Proofpoint and PwC Threat Intelligence have jointly identified a cyber espionage campaign, active since April 2022 through June, delivering the ScanBox exploitation framework to targets who visit a malicious domain posing as an Australian news website.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
2 techniquesThe malicious URLs provided in the emails also appear to use values that are customized for each target... the number string that follows it... appears to be a unique identifier for each recipient... This may be an attempt by the threat actor to correlate traffic to its servers... with custom user identifiers which targets received within the URLs via email.
The framework can collect information from a website’s visitors by using JavaScript to record keypresses and harvest the profiles of the OS, browser, and browser plugins from the client environment.
Initial Access
4 techniquesEarth Empusa also employs watering hole attacks to compromise iOS devices. The group injected their malicious scripts on websites that their targets could potentially visit and load the injected script from it.
“It appears to have started with CVE-2014-3393, a vulnerability in… the Cisco Clientless SSL VPN portal… [allowing] an unauthenticated, remote attacker to modify the content of the Clientless SSL VPN portal…”
Beginning on 12 April 2022, and continuing through mid-June 2022, Proofpoint identified several waves of a phishing campaign... The phishing campaign involved URLs delivered in phishing emails, which redirected victims to a malicious website posing as an Australian news media outlet.
Earth Empusa also used social engineering lures to trick its targets into visiting the phishing pages.
Execution
1 techniqueAll pages were injected with a script to load the cross-site scripting framework BeEF.
Stealth
1 technique“Following the theme… are hostnames of other popular Japanese companies… in an effort to make the traffic blend in with legitimate traffic.”
Credential Access
3 techniques“The file 1.js was a variant of an online script called ‘xss.js’ that was designed to steal form data.”
The framework can collect information from a website’s visitors by using JavaScript to record keypresses
Discovery
2 techniquesEvery 30 seconds, ActionSpy will collect basic device information like IMEI, phone number, manufacturer, battery status, etc., which it sends to the C&C server as a heartbeat request.
Victim browser plugins Identification: This plugin gathers the name, filename, and description of any legitimate browser plugin installed in the victim’s browser... Browser fingerprinting plugin... checks whether Java is installed, and if so what version; The version of ActiveX installed; Whether specific Java web applications are installed...
Collection
4 techniques“The file 1.js was a variant of an online script called ‘xss.js’ that was designed to steal form data.”
The framework can collect information from a website’s visitors by using JavaScript to record keypresses
“Attackers have been able to successfully implant JavaScript code on the login pages that enables them to surreptitiously steal employee credentials as they login…”
The initial script harvests several types of information from visitors... Sending Information about the victim’s browser back to the C2, including: Version of Flash installed; Location; Referrer; User-Agent; Cookie; Character encoding; Screen width and height; Underlying Operating System; Language; Screen’s colour depth.
Command and Control
3 techniquesThe modular ScanBox architecture works by sending data to different responsive PHP scripts hosted on a same server-side folder... /i/v.php?m=b Send victim information back to the C2 ... /i/v.php?m=plug URL that plugins send gathered data back to
“…malicious JavaScript… hosted on the compromised website of a legitimate NGO… leveraged a valid SSL certificate, which kept all communications encrypted.”
Both initial infection vectors delivered first-stage downloader malware to targets. The downloaders retrieved XOR-encoded versions of Meterpreter shellcode.
IOCs tracked for this family
74 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
JavaScript-based web reconnaissance and exploitation framework used to profile victims in the browser, fingerprint systems, collect browser and host data, load modular plugins, keylog keystrokes in iframes, identify browser plugins, perform browser fingerprinting, and support follow-on exploitation or compromise.
Scanbox is a reconnaissance and keylogging framework used for tracking website visitors, collecting user data, and performing keylogging. It is delivered via browser-based attacks, often as a second-stage payload after initial compromise (e.g., via FriarFox). It is used for espionage and surveillance, particularly against dissident and ethnic minority groups.
JavaScript-based reconnaissance framework used on compromised or phishing pages to profile visitors, harvest browser and OS information, and record keypresses to support later-stage attacks.
Web-based exploitation/reconnaissance framework hosted on attacker-controlled sites and used after redirecting visitors from compromised government websites.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.