Loading malware…
WinDealer is a Windows backdoor/RAT malware family associated with the China-linked threat actor LuoYu, also referred to in the provided content as SinisterEye LuoYu. It is described as a primary Windows implant and has been used alongside SpyDealer on Android. Reported delivery tradecraft includes adversary-in-the-middle or ISP/backbone-level interception of Windows software update traffic, specifically manipulation of Windows update mechanisms on ChinaNet AS4134 to deliver WinDealer to targets, including foreign entities operating inside China. The malware is referenced as part of LuoYu operations and is also mentioned in connection with Chinese-origin activity involving WinDealer and ReverseWindow. The content further notes WinDealer RAT among malware families discussed in threat reporting. High-confidence context from the provided material ties WinDealer to espionage-focused operations, Windows targeting, and network-infrastructure-assisted malware delivery rather than conventional user-driven infection vectors.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In a research paper presented by TeamT5, XDealer was shown to be associated with Luoyu, a threat actor with Chinese origins that used the WinDealer and ReverseWindow malware families.
Target Technologies: Windows operating system update mechanisms, specifically Windows software update traffic intercepted and manipulated via adversary-in-the-middle to deliver WinDealer... Malware and Tools: WinDealer (Windows backdoor primary implant), SpyDealer (Android surveillance malware), custom passive MOTS injection framework operating at network infrastructure level.
...SinisterEye... to deliver malware like WinDealer (for Windows) and SpyDealer (for Android)...
3 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access: Supply chain compromise through overseas telecommunications provider, exploiting a trusted third-party network connection to bypass perimeter defenses.
Initial Access: Adversary-in-the-middle attacks confirmed capability to intercept network traffic at ISP-level or backbone-level within AS4134 (ChinaNet). Legitimate software update requests from victim machines are intercepted in transit, with server responses replaced by a malicious payload before reaching the victim.
Active Directory reconnaissance post-compromise.
Initial Access: Adversary-in-the-middle attacks confirmed capability to intercept network traffic at ISP-level or backbone-level within AS4134 (ChinaNet). Legitimate software update requests from victim machines are intercepted in transit, with server responses replaced by a malicious payload before reaching the victim.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.