Loading malware…
Quarian is a Windows backdoor used in cyberespionage operations targeting government organizations in the Middle East and Africa and telecommunications organizations in Asia and the Middle East. Its evolving variants include version 3, also known as Turian; Whitebird has also been identified as a version of the same backdoor lineage. Variants differ in encryption, key exchange, and command identifiers, with a newer variant using TLS through the Windows Schannel API for command-and-control communications.
Quarian deployments use DLL side-loading through legitimate executables to decrypt and execute payload shellcode in memory, reducing exposure on disk. It has replaced the IRAFAU backdoor in compromised environments and provided established access for deploying additional malware, including the QSC modular framework. Operators have used Quarian to modify Windows service configurations to load QSC components. Observed infection chains include exploitation of Microsoft Exchange CVE-2020-0688 followed by ChinaChopper web-shell deployment and installation of Quarian alongside PlugX.
Quarian has been associated with espionage operations linked to CloudComputating, also known as BackdoorDiplomacy or Faking Dragon. It is not exclusive to that actor: Turla deployed an already compiled Quarian implant during a documented 2012 intrusion, replacing its own Wipbot malware to misdirect investigators toward a Chinese attribution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In one case, we could see that this variant was deployed following exploitation of the CVE-2020-0688 vulnerability on the network of a government entity. This vulnerability, which was publicly reported in February 2020, allows an authenticated user to run commands as SYSTEM on a Microsoft Exchange server. | Quarian is a little-known malicious program... we noticed a new variant that was used during several attacks on Middle Eastern and African governments during 2020.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“The Quarian backdoor was used by threat actors to replace IRAFAU with a stealthier method of execution.”
rather they installed a somewhat rare, already compiled piece of Chinese malware by the name of Quarian.
Our investigation found that the target machines had been infected with the Quarian backdoor version 3 (aka Turian) since 2022, and the same attackers had used this access to deploy the QSC framework starting on October 10, 2023.
Our investigation found that the target machines had been infected with the Quarian backdoor version 3 (aka Turian) since 2022, and the same attackers had used this access to deploy the QSC framework starting on October 10, 2023.
Quarian is a little-known malicious program... we noticed a new variant that was used during several attacks on Middle Eastern and African governments during 2020.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
The Command Shell module launches % windir % \ system32 \ cmd . exe as a shell using the CreateProcess API, and data is written to and read from the shell using pipes.
The belief is that the actors recognized researcher systems in their logs and instead of serving the normal second-stage binary, they instead provided a ‘fake’, unrelated piece of malware to cause confusion.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor referenced as the suspected intended payload of a sideloading chain, though execution was prevented before confirmation.
A backdoor referenced as the payload targeted for deployment via a suspected loader in a sideloading chain.
Backdoor referenced as a payload in suspected loader/sideloading chains (payload deleted before execution in this case).
A backdoor used as the initial access and deployment mechanism for QSC and GoClient. It was used to launch command shells, execute batch scripts, copy payloads, and run additional tools during post-compromise activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.