DarkNights

DarkNights is malware targeting Android that ESET tracks as DarkNights and Trend Micro refers to as DarkNimbus. ESET reported that infrastructure associated with the China-aligned threat actor TheWizards was configured to serve DarkNights to Android applications during software update hijacking, including an Android Tencent QQ update flow that delivered plugin-audiofirstpiece.ml from 43.155.62[.]54. ESET also listed 103.243.181[.]120 associated with assetsqq[.]com as DarkNights command-and-control infrastructure. The malware is discussed in the context of links between TheWizards and Sichuan Dianke Network Security Technology Co., Ltd. (UPSEC), which ESET assessed may act as a “digital quartermaster” and which was identified as the supplier of DarkNimbus. Trend Micro attributed DarkNimbus to a separate Chinese threat group tracked as Earth Minotaur, while ESET assessed TheWizards and Earth Minotaur as distinct operators based on differences in tooling, infrastructure, and targeting. High-confidence details in the provided content are limited; beyond its Android targeting, delivery via hijacked update infrastructure, and the cited infrastructure and actor associations, specific capabilities, persistence mechanisms, or additional infection behavior are not described in the source material.