EchoBackdoor
EchoBackdoor is a passive ICMP-based backdoor used in 2024 intrusions against telecommunications providers and critical telecom infrastructure in Southeast Asia/Southwest Asia. It is associated with the nation-state-linked cluster CL-STA-0969, which Unit 42 assessed overlaps heavily with the China-linked group Liminal Panda, with additional tooling overlaps noted with Light Basin, UNC3886, UNC2891, and UNC1945. EchoBackdoor listens for encrypted command-and-control instructions in inbound ICMP echo request packets, reconstructs and executes the received commands, and returns execution results in ICMP echo reply packets. Reporting also states that the reply traffic is sent via unencrypted ICMP echo reply packets. By using ICMP and operating passively without requiring conventional outbound connections, it is intended to make detection harder. In the broader campaign, the actor likely gained initial access via SSH brute-force attacks against telecom authentication systems, used Linux privilege-escalation exploits including CVE-2016-5195, CVE-2021-4034, and CVE-2021-3156, and maintained stealth through DNS tunneling, routing traffic through compromised mobile operators, log clearing, process masquerading, timestomping, and disabling SELinux. EchoBackdoor was part of a larger toolkit that included AuthDoor, GTPDoor, ChronosRAT, NoDepDNS, Cordscan, and an SGSN emulator used in telecom environments. The campaign showed deep knowledge of telecom protocols and infrastructure, and although no confirmed data exfiltration was reported in investigated cases, the activity suggested preparation for persistent espionage and possible collection of mobile subscriber or location-related data.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
EchoBackdoor: A passive ICMP-based backdoor that listens for encrypted instructions in echo request packets. It reconstructs and executes commands and replies via ICMP echo replies, avoiding outbound connections and making detection harder.
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A passive ICMP-based backdoor that receives encrypted instructions via echo requests, executes commands, and replies via ICMP echo replies, making detection difficult.
Passive ICMP-based backdoor: receives encrypted command chunks via inbound ICMP Echo Requests, reconstructs and executes commands, and returns output via ICMP Echo Replies; contrasted with PingPong which actively connects out after a trigger.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.