Loading malware…
Winnti is a backdoor malware family with Windows and Linux variants, used by multiple China-linked threat actors for covert access and data theft. Publicly characterized in 2013, it is closely associated with the Winnti Group and APT41 ecosystem, and has also been used by Earth Lusca and TeleBoyi. Its deployment spans gaming, telecommunications, pharmaceuticals, and technology organizations. Winnti supported early attacks against South Korean gaming companies, and a Linux variant was identified on systems belonging to the German pharmaceutical company Bayer.
Windows deployments can comprise an installer, a loader, and the backdoor payload. Execution techniques include DLL search-order hijacking, DLL side-loading through legitimate applications, and signed binary proxy execution using Rundll32. An analyzed variant manually maps its DLL into memory and erases its PE headers to impede detection and analysis. The family also uses rootkit components to conceal activity.
Certain Windows variants include a driver component known as NdisReroute, which recognizes an initial TCP handshake and redirects traffic from ports already occupied by legitimate applications to the malware's user-space component. This allows covert communications through existing network services. An analyzed Winnti variant incorporates the open-source iodine implementation for DNS tunneling, using encoded subdomains to carry command-and-control traffic. These mechanisms support concealed remote access and the theft of data and files.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
13 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"At the second victim, we observed a loader that is highly similar to previous Winnti v.4 malware loaders" used to decrypt and execute a payload.
The 2016 attack on TeamViewer, in which the hackers breached their network using Winnti (backdoor), was also believed to be linked with this group.
Earth Lusca [is] known to rely heavily on Cobalt Strike, ShadowPad, Winnti and Spyder malware families.
In April 2013, Kaspersky disclosed a report called “Winnti - More than just a game". The researchers reported that in Q3 2011, the Winnti group's malware was detected on a large number of computers...
In April 2013, Kaspersky disclosed a report called “Winnti - More than just a game". The researchers reported that in Q3 2011, the Winnti group's malware was detected on a large number of computers...
+7 more in the app. View in Mallory
33 distinct techniques documented for this family, organized by ATT&CK tactic.
APT41 Winnti ELF backdoor with near-maximum entropy connects to three typosquat domains.
APT41 exploits vulnerabilities in public-facing applications and deploys malware such as Winnti and ShadowPad to maintain persistence.
References include 'APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks,' ShadowPad reporting, and third-party compromise reporting involving Air India.
The modus operandi of this group was to compromise developer workstations that had access to source code repositories and then install backdoors and other malware into legitimate software.
"The company appears to have trouble sourcing malware and relies on generally crude methods (i.e., phishing)." / "a 'forensics link' (phishing) is delivered to the victim ... the end-goal is to obtain the victim’s Outlook credentials."
The group has since earned infamy for being involved in malicious activities associated with targeted attacks, such as deploying spear-phishing campaigns and building a backdoor.
"interactive command execution capabilities"
$uuid_lookup = "/usr/sbin/dmidecode | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"
The attack surface is obvious: the GOT is a writeable table of function pointers. If we overwrite the puts entry with our own address, every future call to puts in the victim will land in our code instead of libc.
The threat actors have also been known to deploy the Winnti malware and the China Chopper web shell...
The library used to hide Winnti’s system activity is a copy of the open-source userland rootkit Azazel, with minor changes. When executed, it will register symbols for multiple commonly used functions, including: open(), rmdir(), and unlink(), and modify their returns to hide the malware’s operations.
In some instances, Winnti operators wrote the names of their targets directly into the malware, obfuscated with a rolling XOR cipher.
Old tool we created and used to sniff and decrypt Winnti's traffic within networks after nearly a year to reverse this shit.
The attack surface is obvious: the GOT is a writeable table of function pointers. If we overwrite the puts entry with our own address, every future call to puts in the victim will land in our code instead of libc.
The group also engaged in the theft of digital certificates which they then used to sign their malware to make them stealthier.
Old tool we created and used to sniff and decrypt Winnti's traffic within networks after nearly a year to reverse this shit.
At the heart of this new Winnti backdoor is a focused cloud credential harvesting engine that systematically walks through each major provider’s metadata and credential storage mechanisms. On AWS, the implant queries the instance metadata endpoint at 169.254.169.254 to extract IAM role credentials, while also reading the standard ~/.aws/credentials file if it exists. On GCP, it requests service account tokens from the metadata server and checks for application default credentials, and on Azure it pulls managed identity tokens from the IMDS endpoint and scans ~/.azure profiles. For Alibaba Cloud, the malware targets ECS metadata to obtain RAM role credentials and inspects the local Alibaba CLI configuration files.
Harvests cloud instance metadata.
Kaspersky researchers uncovered that the digital signature used to sign the original Winnti malware was stolen from another video game vendor known as KOG... the Winnti group had used at least 18 stolen code-signing certificates in its campaigns
Inside the cloud network, the implant supports lateral movement by periodically sending UDP broadcast beacons to 255.255.255.255 on port 6006, allowing other compromised hosts to discover each other and share tasking without extra direct C2 traffic.
Old tool we created and used to sniff and decrypt Winnti's traffic within networks after nearly a year to reverse this shit.
This script identifies infected hosts by first sending a custom hello packet, immediately followed by an encoded request for host information, and then parsing the response.
When a winnti infection is found the script gathers basic host information by sending a query to the backdoor and printing the response.
In 2009, the Winnti group shifted to targeting gaming companies in South Korea using a self-named data- and file-stealing malware.
a feature of recent versions of Winnti we came across in the Linux variant (as well as Windows) that allows the operators to initiate a connection directly to an infected host, without requiring a connection to a control server. This secondary communication channel may be used by operators when access to the hard-coded control servers is disrupted.
For years, TAU has reversed and emulated the network Command and Control (C2) protocols of high-profile malware families... Continuing its research, TAU has discovered additional Winnti 4.0 C2 servers actively used over the last two years.
According to the Breakglass Intelligence report, the backdoor uses an unusual but effective command-and-control strategy built around SMTP traffic over port 25, rather than more common HTTPS-based channels. This choice allows the implant to disguise its C2 as email traffic... All collected secrets are encrypted using a hardcoded AES-256 key and staged locally prior to exfiltration through the SMTP-based C2 channel.
prior reporting suggests that the operators commonly deploy plugins for remote command execution, file exfiltration, and socks5 proxying on the infected host.
The driver component of Winnti (aka "NdisReroute") is able to reroute network traffic from ports that are already occupied by legit applications to the malware's userspace component. The first packet of a TCP stream signals the driver that the stream shall be rerouted.
References include 'Attacks on East Asia using Google Code for Command and Control' and 'Winnti Abuses GitHub for C&C Communications.'
This component is primarily designed to handle communications and the deployment of modules directly from the command-and-control servers.
The malware is a modularized Remote Access Trojan (RAT) supporting multiple C2 protocols.
The driver component of Winnti (aka "NdisReroute") is able to reroute network traffic from ports that are already occupied by legit applications to the malware's userspace component.
prior reporting suggests that the operators commonly deploy plugins for remote command execution, file exfiltration, and socks5 proxying on the infected host.
the Egregor operators stole unencrypted files from the company and leaked a 380MB archive on its darknet leak site
772 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
62 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.