Demodex

Demodex is a Windows kernel-mode rootkit associated with Chinese cyber-espionage activity, most notably the GhostEmperor and Salt Typhoon intrusion clusters. It has been used in long-dwell operations against telecommunications providers, government entities, and related vendors, particularly in Asia and in telecom-focused espionage campaigns. Demodex is deployed after initial compromise as a stealth and persistence component on servers and vendor systems, where it supports continued attacker access while concealing malicious activity from defenders and forensic tooling.

A defining characteristic of Demodex is its kernel-level operation and driver-based stealth. Public reporting has described it as being loaded through abuse of a signed third-party driver to bypass Windows driver signature enforcement, enabling installation of an unsigned malicious driver. Once active, the rootkit hides attacker artifacts including files, services, registry objects, and network connections, and has been reported to hook kernel components to obscure malware-related TCP activity and mask callback origins. Demodex has also been described as incorporating obfuscation and anti-analysis measures, including techniques intended to frustrate memory forensics and reverse engineering.

Demodex appears as part of broader multi-stage post-compromise frameworks rather than as a standalone initial-access tool. It has been observed alongside backdoors such as GhostSpider and SnappyBee and with operator tooling including Cobalt Strike. In some intrusion chains, SnappyBee has been used to deploy the Demodex rootkit. Reporting also indicates remote deployment in already-compromised environments using administrative execution mechanisms. Its role is consistent with maintaining covert persistence, supporting post-exploitation, and enabling defense evasion during extended espionage operations.

Operationally, Demodex is notable because it reflects continued use of sophisticated rootkit tradecraft in modern state-linked intrusions. Its use against telecommunications environments and contractor networks indicates a focus on surveillance, durable access, and stealth within strategically important infrastructure.