MalwareUsed by 1 actorExploits 8 CVEs

Demodex

Demodex is a Windows kernel-mode rootkit used in cyber-espionage intrusions attributed to the Chinese-nexus GhostEmperor activity cluster, which is also associated in some reporting with Earth Estries/Salt Typhoon. It has targeted telecommunications providers, government entities, and related service-provider environments, particularly in Southeast Asia, with broader activity affecting other regions. Demodex provides stealth and persistence by concealing malware-associated files, services, registry artifacts, and network connections. It uses kernel-level hooking and anti-forensic measures, including techniques intended to obscure registry callback origins and evade forensic inspection. Observed deployment chains use multistage loaders, in-memory execution, reflective loading, encrypted configuration and shellcode, and obfuscation to reduce endpoint detection and impede sandbox analysis. Installations have abused a signed vulnerable driver to bypass Windows Driver Signature Enforcement and load the unsigned rootkit. Demodex has been deployed following compromise of public-facing servers and through remote execution in already compromised environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

8 CVES

CVE-2021-26855ProxyLogon SSRF in Microsoft Exchange Server

GhostEmperor updated their Demodex rootkit to evade Endpoint Detection & Response (EDR) detection, impede sandbox analysis, and use a reflective loader to run in memory.

via imda singaporeimda.gov.sg

CVE-2024-21887Command injection in Ivanti Connect Secure and Policy SecureExploited in the wild

We have observed them exploiting server-based N-day vulnerabilities, including the following: Ivanti Connect Secure VPN Exploitation (CVE-2023-46805 and CVE-2024-21887) A chain of exploits to bypass authentication, craft malicious requests, and execute arbitrary commands with elevated privileges.

via trendai security blogtrendaisecurity.com

CVE-2022-3236Remote Code Execution in Sophos Firewall User Portal and WebadminExploited in the wild

CVE-2022-3236 A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.

via trendai security blogtrendaisecurity.com

CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication BypassExploited in the wild

via trendai security blogtrendaisecurity.com

CVE-2023-48788Unauthenticated SQL Injection RCE in Fortinet FortiClient EMSExploited in the wild

We have observed them exploiting server-based N-day vulnerabilities, including the following: CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Vulnerability

via trendai security blogtrendaisecurity.com

CVE-2021-26857Microsoft Exchange Unified Messaging Insecure Deserialization RCEExploited in the wild

ProxyLogon (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) A set of four chained vulnerabilities that perform remote code execution (RCE) in Microsoft Exchange servers. | We found that they implanted the DEMODEX rootkit on vendor machines.

via trendai security blogtrendaisecurity.com

CVE-2021-26858Post-authentication Arbitrary File Write in Microsoft Exchange ServerExploited in the wild

via trendai security blogtrendaisecurity.com

CVE-2021-27065Microsoft Exchange Server ECP Arbitrary File WriteExploited in the wild

via trendai security blogtrendaisecurity.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Salt Typhoon

An updated DEMODEX rootkit was observed where the attacker replaced the first-stage PowerShell script with a CAB file containing the necessary registry data, including the encrypted configuration and shellcode payload.

via imda singaporeimda.gov.sg

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

In 2021, they gained initial access through exploiting vulnerabilities in public-facing servers such as Microsoft Exchange and used ProxyLogon vulnerability to gain access and perform remote code execution.

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

Once initial access was obtained, WMIExec (Impacket ... ) was used to remotely execute a batch file.

T1059.001PowerShellEvidence3

One of the extracted files was a Powershell script that creates a malicious service DLL.

T1059.003Windows Command ShellEvidence2

WMIExec ... was used to remotely execute a batch file. The batch file executed built-in Windows tools to extract and import files.

Persistence

1 technique

T1112Modify RegistryEvidence1

The advisory lists T1112, Modify Registry, among the MITRE ATT&CK techniques identified for the threat behaviours.

Privilege Escalation

1 technique

T1068Exploitation for Privilege EscalationEvidence1

The Core-Implant ... had to bypass the Driver Signature Enforcement (DSE) security feature ... 'Cheat Engine' ... was used to manipulate memory and execute code in kernel space to install Demodex.

Stealth

6 techniques

T1014RootkitEvidence3

They execute a multi-stage infection chain ... to deploy encrypted payloads, such as DEMODEX rootkit. An updated DEMODEX rootkit was observed.

T1027Obfuscated Files or InformationEvidence3

Encrypted configurations and shellcode are stored in registry keys, while reflective loaders decrypt and execute these components in memory, evading detection.

T1036.004Masquerade Task or ServiceEvidence1

A Powershell script ... creates a malicious service DLL that masquerades a legitimate Windows system process to avoid detection.

T1070.004File DeletionEvidence2

Once the installation is complete, the CAB file is deleted, to hinder forensics.

T1140Deobfuscate/Decode Files or InformationEvidence1

The advisory lists T1140, Deobfuscate/Decode File or Information, among the MITRE ATT&CK techniques identified for the threat behaviours.

T1620Reflective Code LoadingEvidence2

[The rootkit] uses reflective loader (loading DLL in memory) to execute the Core-Implant.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

The advisory lists T1112, Modify Registry, among the MITRE ATT&CK techniques identified for the threat behaviours.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

The advisory lists T1003, OS Credential Dumping, among the MITRE ATT&CK techniques identified for the threat behaviours.

Discovery

2 techniques

T1049System Network Connections DiscoveryEvidence1

The advisory lists T1049, System Network Connections Discovery, among the MITRE ATT&CK techniques identified for the threat behaviours.

T1069.002Domain GroupsEvidence1

The Powershell script ... creates a malicious service DLL that masquerades a legitimate Windows system process ... The service DLL was then used to install Demodex rootkit.

Lateral Movement

1 technique

T1021Remote ServicesEvidence2

The advisory lists T1021, Remote Services, among the MITRE ATT&CK techniques identified for the threat behaviours; WMIExec was used to remotely execute a batch file.

Collection

1 technique

T1005Data from Local SystemEvidence1

The advisory lists T1005, Data from Local System, among the MITRE ATT&CK techniques identified for the threat behaviours.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The Core-Implant ... was used to manage Command and Control (C2) communication ... imap.dateupdata[.]com [is identified as] C2.

T1105Ingress Tool TransferEvidence2

we found that the attackers downloaded malicious tools from their C&C server (23.81.41[.]166)

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The advisory lists T1041, Exfiltration Over C2 Channel, among the MITRE ATT&CK techniques identified for the threat behaviours.

INDICATORS OF COMPROMISE

IOCs tracked for this family

35 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

28 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app2 months ago

domain●●●●●●●●●●●●View more in app2 months ago

ip.v4●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

trendai security blogNews

Aug 14, 2026

Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions | TrendAI (US)

A rootkit used by Earth Estries for stealth and persistence, including on vendor machines and long-term targets. The report describes multi-stage installation, anti-analysis via control flow flattening, and newer CAB-bundled deployment variants.

codebyNews

Jul 13, 2026

Salt Typhoon APT атаки на телеком - TTP и детект

Kernel-mode rootkit deployed by Salt Typhoon on servers as part of its server-side toolset.

darktrace blogNews

Feb 10, 2026

AI/LLM-Generated Malware Used to Exploit React2Shell

Rootkit referenced as an additional payload deployed by SnappyBee in the described campaigns.

darktrace blogNews

Feb 5, 2026

AppleScript Abuse: Unpacking a macOS Phishing Campaign

Rootkit referenced as an additional payload deployed by SnappyBee in the described campaigns.

+10 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching35

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities8

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Demodex