MalwareUsed by 2 actorsExploits 2 CVEs

ReShell

RESHELL (also styled ReShell or Reshell) is a previously undocumented, ConfuserEX-packed .NET backdoor used in cyberespionage intrusions. It supports host information collection, file deployment, command execution, and AES-encrypted command-and-control communications. It has been deployed on compromised Windows systems by Earth Krahang, a China-nexus espionage actor that has targeted government entities, particularly in Southeast Asia, through spear-phishing and exploitation of public-facing servers. A separate long-running intrusion cluster targeting a Southeast Asian government, assessed with moderate confidence as Alloy Taurus (GALLIUM), also used RESHELL alongside web shells and credential-access tooling. In that activity, attackers attempted to execute the backdoor after exploiting Microsoft Exchange Server vulnerabilities.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2022-21587Oracle E-Business Suite Web Applications Desktop Integrator Unauthenticated Arbitrary File Upload RCEExploited in the wild

Earth Krahang is known to conduct spear-phishing attacks and exploiting vulnerable public-facing servers such as Oracle Web Applications Desktop Integrator CVE-2022-21587 (CVSS 9.8) ... to install backdoors such as Cobalt Strike, RESHELL, and XDealer. | Earth Krahang was observed exploiting public-facing servers "to install backdoors such as Cobalt Strike, RESHELL, and XDealer." The advisory identifies RESHELL C&C servers.

via imda singaporeimda.gov.sg

CVE-2023-32315Openfire Admin Console Authentication BypassExploited in the wild

Earth Krahang is known to conduct spear-phishing attacks and exploiting vulnerable public-facing servers such as ... OpenFire CVE-2023-32315 (CVSS 7.5) to install backdoors such as Cobalt Strike, RESHELL, and XDealer. | Earth Krahang was observed exploiting public-facing servers "to install backdoors such as Cobalt Strike, RESHELL, and XDealer." The advisory identifies RESHELL C&C servers.

via imda singaporeimda.gov.sg

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Earth Krahang

Earth Krahang was observed exploiting public-facing servers "to install backdoors such as Cobalt Strike, RESHELL, and XDealer." The advisory identifies RESHELL C&C servers.

via imda singaporeimda.gov.sg

GALLIUM

Earth Krahang delivers backdoors to establish access to victim machines. Cobalt Strike and two custom backdoors, RESHELL and XDealer, were employed during the initial stage of attack.

via trend micro researchtrendmicro.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

4 techniques

T1584.004ServerEvidence1

Earth Krahang abuses the trust between governments to conduct their attacks. We found that the group frequently uses compromised government webservers to host their backdoors and send download links to other government entities via spear phishing emails.

T1588.001MalwareEvidence2

The advisory identifies XDealer, RESHELL, Cobalt Strike, PlugX, and ShadowPad among campaign malware.

T1608.001Upload MalwareEvidence2

Listed in the Earth Krahang resource-development TTP table.

T1608.005Link TargetEvidence1

Since the malicious link uses a legitimate government domain of the compromised server, it will appear less suspicious to targets and may even bypass some domain blacklists.

Initial Access

3 techniques

T1190Exploit Public-Facing ApplicationEvidence3

Earth Krahang exploited Oracle Web Applications Desktop Integrator CVE-2022-21587 and OpenFire CVE-2023-32315.

T1566.001Spearphishing AttachmentEvidence2

Earth Krahang also makes use of spear phishing email to attack its targets... In one case, the actor used a compromised mailbox from a government entity to send a malicious attachment to 796 email addresses.

T1566.002Spearphishing LinkEvidence1

the group frequently uses compromised government webservers to host their backdoors and send download links to other government entities via spear phishing emails.

Execution

2 techniques

T1053.005Scheduled TaskEvidence1

Maintaining backdoor persistence with task scheduling

T1203Exploitation for Client ExecutionEvidence1

the emails are intended trick their targets into opening attachments or embedded URL links that ultimately lead to the execution of a prepared backdoor file on the victim’s machine.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Maintaining backdoor persistence with task scheduling

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Maintaining backdoor persistence with task scheduling

Stealth

1 technique

T1036.007Double File ExtensionEvidence1

backdoor filenames are usually related to geopolitical topics... 'Plan of Action (POA) - TH-VN - TH_Counterdraft_as of Feb 2022.doc.exe'

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence2

The advisory identifies XDealer, RESHELL, and Cobalt Strike command-and-control servers and domains.

T1105Ingress Tool TransferEvidence2

The campaign installed backdoors including Cobalt Strike, RESHELL, and XDealer on compromised servers.

T1573Encrypted ChannelEvidence1

its command-and-control (C&C) communication is encrypted with the AES algorithm.

INDICATORS OF COMPROMISE

IOCs tracked for this family

19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

17 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 years ago

hash.md5●●●●●●●●●●●●View more in app2 years ago

hash.sha1●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

the hacker newsNews

Mar 27, 2024

Two Chinese APT Groups Ramp Up Cyber Espionage Against ASEAN Countries

A bespoke malware/backdoor used by Earth Krahang in espionage intrusions.

trend micro researchNews

Mar 18, 2024

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

A simple .NET backdoor with capabilities to collect information, drop files, and execute system commands. Its binaries are packed with ConfuserEX and its C2 communication is encrypted with AES.

palo alto networks unit 42 blogNews

Sep 22, 2023

Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government

Previously unknown backdoor (per Unit 42) used for access/persistence in the described espionage cluster.

palo alto networks unit 42 blogNews

Sep 22, 2023

Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Previously undocumented .NET backdoor (windows.exe) configured with an embedded C2 IP to enable remote arbitrary command execution.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching19

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ReShell