DinodasRAT
DinodasRAT, also referred to as XDealer, is a remote access trojan associated with China-linked espionage activity. The provided content links it to the China-nexus threat actor Earth Krahang, which has used spear-phishing and exploitation of public-facing Openfire and Oracle servers since at least early 2022 to deploy malware including PlugX, ShadowPad, ReShell, and DinodasRAT. The malware has also been reported in a Linux variant used by China-linked groups to target Linux servers for espionage. Reported targets include Red Hat and Ubuntu systems, with activity observed since 2022 and victims primarily in China, Taiwan, Turkey, and Uzbekistan since October 2023. Described capabilities include persistence mechanisms, encrypted communication with a command server, and full control over compromised systems. The broader Earth Krahang activity targeted 116 entities across 35 countries, with a strong focus on Southeast Asia.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earth Krahang ... deliver bespoke malware such as PlugX, ShadowPad, ReShell, and DinodasRAT (aka XDealer).
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesEarth Krahang that has targeted 116 entities spanning 35 countries by leveraging spear-phishing and flaws in public-facing Openfire and Oracle servers to deliver bespoke malware such as PlugX, ShadowPad, ReShell, and DinodasRAT.
Earth Krahang that has targeted 116 entities spanning 35 countries by leveraging spear-phishing and flaws in public-facing Openfire and Oracle servers to deliver bespoke malware such as PlugX, ShadowPad, ReShell, and DinodasRAT.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan used by Earth Krahang in cyber espionage campaigns.
Remote access trojan targeting Linux servers, used for espionage, with persistence and encrypted C2 communication.
Remote access trojan (RAT); the content notes a Linux variant used by China-linked threat actors in espionage activity.
Remote access trojan with a Linux variant referenced here as used by China-linked groups.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.