MalwareUsed by 2 actorsExploits 2 CVEs

XDealer

XDealer, also known as DinodasRAT, is a remote-access backdoor used in cyberespionage operations. It has Windows and Linux variants and is deployed with associated loader, installer, and stealer components. Earth Krahang has used XDealer since at least 2023, increasingly replacing its earlier RESHELL backdoor, against government organizations and telecommunications, postal, and media entities, particularly in Southeast Asia. Observed delivery includes spear-phishing archives containing shortcut files that execute XDealer while displaying decoy documents, as well as deployment from web shells on compromised public-facing servers. XDealer has also been associated with activity attributed to LuoYu.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2022-21587Oracle E-Business Suite Web Applications Desktop Integrator Unauthenticated Arbitrary File Upload RCEExploited in the wild

Earth Krahang is known to conduct spear-phishing attacks and exploiting vulnerable public-facing servers such as Oracle Web Applications Desktop Integrator CVE-2022-21587 (CVSS 9.8) ... to install backdoors such as Cobalt Strike, RESHELL, and XDealer. | Earth Krahang exploits vulnerable public-facing servers "to install backdoors such as Cobalt Strike, RESHELL, and XDealer." The IoCs also identify an XDealer loader, installer, stealer module, LNK/VBS files, and a Linux version.

via imda singaporeimda.gov.sg

CVE-2023-32315Openfire Admin Console Authentication BypassExploited in the wild

Earth Krahang is known to conduct spear-phishing attacks and exploiting vulnerable public-facing servers such as ... OpenFire CVE-2023-32315 (CVSS 7.5) to install backdoors such as Cobalt Strike, RESHELL, and XDealer. | Earth Krahang exploits vulnerable public-facing servers "to install backdoors such as Cobalt Strike, RESHELL, and XDealer." The IoCs also identify an XDealer loader, installer, stealer module, LNK/VBS files, and a Linux version.

via imda singaporeimda.gov.sg

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Earth Krahang

Earth Krahang exploits vulnerable public-facing servers "to install backdoors such as Cobalt Strike, RESHELL, and XDealer." The IoCs also identify an XDealer loader, installer, stealer module, LNK/VBS files, and a Linux version.

via imda singaporeimda.gov.sg

LuoYu

Since 2023, the Earth Krahang shifted to another backdoor (named XDealer by TeamT5 and DinodasRAT by ESET). Compared to RESHELL, XDealer provides more comprehensive backdoor capabilities.

via trend micro researchtrendmicro.com

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

6 techniques

T1584.004ServerEvidence1

Earth Krahang abuses the trust between governments to conduct their attacks. We found that the group frequently uses compromised government webservers to host their backdoors and send download links to other government entities via spear phishing emails.

T1586.002Email AccountsEvidence1

In one case, the actor used a compromised mailbox from a government entity to send a malicious attachment to 796 email addresses belonging to the same entity.

T1588.001MalwareEvidence2

The advisory identifies XDealer, RESHELL, Cobalt Strike, PlugX, and ShadowPad among campaign malware.

T1588.003Code Signing CertificatesEvidence1

we found that some of the XDealer DLL loaders were signed with valid code signing certificates issued by GlobalSign to two Chinese companies.

T1608.001Upload MalwareEvidence2

Listed in the Earth Krahang resource-development TTP table.

T1608.005Link TargetEvidence1

Since the malicious link uses a legitimate government domain of the compromised server, it will appear less suspicious to targets and may even bypass some domain blacklists.

Initial Access

3 techniques

T1190Exploit Public-Facing ApplicationEvidence3

Earth Krahang exploited Oracle Web Applications Desktop Integrator CVE-2022-21587 and OpenFire CVE-2023-32315.

T1566.001Spearphishing AttachmentEvidence3

Earth Krahang is known to conduct spear-phishing attacks; the TTP table specifies spear-phishing attachments.

T1566.002Spearphishing LinkEvidence1

the group frequently uses compromised government webservers to host their backdoors and send download links to other government entities via spear phishing emails.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

Maintaining backdoor persistence with task scheduling

T1203Exploitation for Client ExecutionEvidence1

the emails are intended trick their targets into opening attachments or embedded URL links that ultimately lead to the execution of a prepared backdoor file on the victim’s machine.

T1204.002Malicious FileEvidence2

The advisory includes XDealer LNK and VBS files and lists malicious-file user execution.

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

Maintaining backdoor persistence with task scheduling

T1547Boot or Logon Autostart ExecutionEvidence1

The persistence process is quite extensive and covers multiple Ubuntu versions and RedHat distributions... achieves persistence by one of the following methods: Method 1 (Ubuntu) – rc.local enabled via systemd... Method 2 (Red Hat) – init.d script... Method 3 (Red Hat) – rc.local

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

Maintaining backdoor persistence with task scheduling

T1547Boot or Logon Autostart ExecutionEvidence1

Stealth

1 technique

T1036.007Double File ExtensionEvidence2

Listed under defense evasion in the Earth Krahang TTP table.

Lateral Movement

1 technique

T1534Internal SpearphishingEvidence1

the actor used a compromised mailbox from a government entity to send a malicious attachment to 796 email addresses belonging to the same entity.

Collection

1 technique

T1119Automated CollectionEvidence1

Listed under collection in the Earth Krahang TTP table.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence2

The advisory identifies XDealer, RESHELL, and Cobalt Strike command-and-control servers and domains.

T1105Ingress Tool TransferEvidence2

The campaign installed backdoors including Cobalt Strike, RESHELL, and XDealer on compromised servers.

INDICATORS OF COMPROMISE

IOCs tracked for this family

56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

51 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

picus security blogNews

Oct 23, 2025

Earth Krahang APT Group: Global Government Cyberespionage Campaigns (2022–2024) and TTP Analysis

Xdealer is a backdoor malware deployed via spear-phishing campaigns by the Earth Krahang APT group. It is used to gain persistent access to victim systems, enabling espionage and further malicious activity.

trend micro researchNews

Mar 18, 2024

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

A more feature-rich backdoor used on both Windows and Linux. Early packages included an installer, XDealer DLL, stealer module DLL, ID file, and LNK/loader. The stealer module can take screenshots, steal clipboard data, and log keystrokes.

jpcert blogNews

Mar 22, 2022

JSAC 2022 -Day 1-

Malware newly used by LuoYu since JSAC2021 (no further technical detail provided in the content).

imda singaporeNews

Sep 10, 2026

A backdoor deployed by Earth Krahang, with associated loader, installer, credential-stealing module, and Windows and Linux components.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching56

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

XDealer