Loading malware…
Hisoka is a custom backdoor associated with the xHunt espionage cluster, which has targeted organizations in Kuwait, particularly in the transportation, shipping, and government sectors. It was observed in 2019 as part of a broader toolset that also included Sakabota, Killua, Gon, EYE, Netero, TriFive, and Snugy. Analysis indicates Hisoka shares substantial development lineage with Sakabota and is likely part of the same evolving malware ecosystem.
Hisoka functions as a covert remote-access implant used after compromise to maintain access and execute operator tasking. Multiple variants were observed. Earlier variants used HTTP and DNS tunneling for command and control, while version 0.9 added a more unusual email-based channel that abused Exchange Web Services. In that mode, the malware authenticated with stolen credentials to a legitimate Exchange account and exchanged commands and results through saved draft messages rather than normal sent mail, using mailbox folders as a stealthy command channel. This tradecraft aligns with xHunt’s emphasis on blending malicious traffic into legitimate enterprise services.
Operational reporting places Hisoka in intrusions against Kuwaiti transportation and shipping organizations, where it served as an initial foothold for follow-on activity. After access through Hisoka, operators deployed additional post-exploitation tooling for reconnaissance, remote command execution, network discovery, and operational cleanup. The malware family is therefore best understood as a persistence and command-and-control backdoor within a bespoke espionage framework rather than a commodity implant.
Hisoka is linked to long-term intelligence collection operations focused on sensitive organizations in Kuwait. Its use of multiple command channels, including DNS tunneling and Exchange-based draft messaging, demonstrates an emphasis on resilience, stealth, and defense evasion. The malware is associated with xHunt activity, although broader attribution overlaps with other regional intrusion activity have remained unconfirmed at the operator level.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
This same general technique was used by the email-based C2 in the Hisoka tool discussed in the initial publication about the xHunt campaign.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
This method uses Exchange Web Services (EWS) and stolen credentials to create email “drafts” to communicate between the actor and the tool.
This method uses Exchange Web Services (EWS) and stolen credentials to create email “drafts” to communicate between the actor and the tool.
This method uses Exchange Web Services (EWS) and stolen credentials to create email “drafts” to communicate between the actor and the tool.
This method uses Exchange Web Services (EWS) and stolen credentials to create email “drafts” to communicate between the actor and the tool.
The payload is base64 encoded and exists as a certificate, which Hisoka v0.9 uses certutil.exe -decode <cwd>\msdtd.txt <cwd>\msdtd.sys on the base64 encoded payload.
Unlike Hisoka, which monitors for local logins and RDP sessions and subsequently logs them to the registry for later exfiltration, EYE monitors for these logins to kill the processes
Figure 3 shows the email draft we created to test the C2 channel that issues the command C-get C:\\Windows\\Temp\\test.txt , which Hisoka will parse and treat as a command to upload the file at the path C:\Windows\Temp\test.txt .
On June 18, this file was observed being transferred to another system via the Server Message Block (SMB) protocol from an internal IT service desk account.
On June 30, we observed related activity that was quite interesting, as the actor used a third-party help desk service account to copy the files to an additional system on the network.
In the case of the file upload command, Hisoka will attach a file of interest to the email draft as well.
Hisoka is a backdoor malware that uses both HTTP and DNS tunneling for C2 communication. | These tools not only use HTTP for their command and control (C2) channels, but certain variants of these tools use DNS tunneling or emails to communicate with their C2 as well.
This method uses Exchange Web Services (EWS) and stolen credentials to create email “drafts” to communicate between the actor and the tool.
The otc.dll file is a tool named Killua that is a simple backdoor that allows an actor to issue commands from a C2 server to run on the infected system by communicating back and forth using DNS tunneling.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.