ScrambleCross

ScrambleCross, also known as SideWalk, is a modular in-memory Windows backdoor associated with APT41, including activity tracked as Earth Baku. It has been described as a shellcode-based, position-independent implant used in cyberespionage operations against enterprises and government entities, particularly in the Indo-Pacific region, with victims reported across sectors including airlines, automotive, infrastructure, media, publishing, IT, and computer hardware.

ScrambleCross is typically delivered as a payload by the StealthVector and StealthMutant loaders, and has also been observed alongside Cobalt Strike in the same intrusion sets. The malware communicates with command-and-control infrastructure to receive tasking and stage additional plugins in memory, reflecting a modular architecture intended for flexible post-compromise operations. Reported functionality includes encrypted command-and-control communications, support for multiple transport protocols including TCP, HTTP, and HTTPS, and plugin-based expansion of capabilities. It has been assessed as a refactored successor to the earlier Crosswalk backdoor, and later reporting characterizes SneakCross as its successor.

Observed intrusion chains associated with ScrambleCross include exploitation of public-facing Microsoft SQL Server instances, exploitation of Microsoft Exchange ProxyLogon vulnerability CVE-2021-26855 with web-shell deployment, and possible malicious email attachment delivery. In compromised environments, the malware has been used as part of broader espionage activity involving reconnaissance, lateral movement, persistence tooling, privilege escalation, and data theft. ScrambleCross infections have also been identified in investigations involving deeper compromise by APT41-linked operators, including environments where firmware-level persistence was present, although ScrambleCross itself is a user-mode implant rather than a firmware component.