Loading malware…
XDealer, also known as DinodasRAT, is a remote-access backdoor used in cyberespionage operations. It has Windows and Linux variants and is deployed with associated loader, installer, and stealer components. Earth Krahang has used XDealer since at least 2023, increasingly replacing its earlier RESHELL backdoor, against government organizations and telecommunications, postal, and media entities, particularly in Southeast Asia. Observed delivery includes spear-phishing archives containing shortcut files that execute XDealer while displaying decoy documents, as well as deployment from web shells on compromised public-facing servers. XDealer has also been associated with activity attributed to LuoYu.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earth Krahang exploits vulnerable public-facing servers "to install backdoors such as Cobalt Strike, RESHELL, and XDealer." The IoCs also identify an XDealer loader, installer, stealer module, LNK/VBS files, and a Linux version.
Since 2023, the Earth Krahang shifted to another backdoor (named XDealer by TeamT5 and DinodasRAT by ESET). Compared to RESHELL, XDealer provides more comprehensive backdoor capabilities.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Earth Krahang abuses the trust between governments to conduct their attacks. We found that the group frequently uses compromised government webservers to host their backdoors and send download links to other government entities via spear phishing emails.
In one case, the actor used a compromised mailbox from a government entity to send a malicious attachment to 796 email addresses belonging to the same entity.
The advisory identifies XDealer, RESHELL, Cobalt Strike, PlugX, and ShadowPad among campaign malware.
we found that some of the XDealer DLL loaders were signed with valid code signing certificates issued by GlobalSign to two Chinese companies.
Listed in the Earth Krahang resource-development TTP table.
Since the malicious link uses a legitimate government domain of the compromised server, it will appear less suspicious to targets and may even bypass some domain blacklists.
Earth Krahang exploited Oracle Web Applications Desktop Integrator CVE-2022-21587 and OpenFire CVE-2023-32315.
Earth Krahang is known to conduct spear-phishing attacks; the TTP table specifies spear-phishing attachments.
the group frequently uses compromised government webservers to host their backdoors and send download links to other government entities via spear phishing emails.
Maintaining backdoor persistence with task scheduling
the emails are intended trick their targets into opening attachments or embedded URL links that ultimately lead to the execution of a prepared backdoor file on the victim’s machine.
The advisory includes XDealer LNK and VBS files and lists malicious-file user execution.
Maintaining backdoor persistence with task scheduling
The persistence process is quite extensive and covers multiple Ubuntu versions and RedHat distributions... achieves persistence by one of the following methods: Method 1 (Ubuntu) – rc.local enabled via systemd... Method 2 (Red Hat) – init.d script... Method 3 (Red Hat) – rc.local
Maintaining backdoor persistence with task scheduling
The persistence process is quite extensive and covers multiple Ubuntu versions and RedHat distributions... achieves persistence by one of the following methods: Method 1 (Ubuntu) – rc.local enabled via systemd... Method 2 (Red Hat) – init.d script... Method 3 (Red Hat) – rc.local
Listed under defense evasion in the Earth Krahang TTP table.
the actor used a compromised mailbox from a government entity to send a malicious attachment to 796 email addresses belonging to the same entity.
Listed under collection in the Earth Krahang TTP table.
The advisory identifies XDealer, RESHELL, and Cobalt Strike command-and-control servers and domains.
The campaign installed backdoors including Cobalt Strike, RESHELL, and XDealer on compromised servers.
56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.