Loading malware…
RESHELL (also styled ReShell or Reshell) is a previously undocumented, ConfuserEX-packed .NET backdoor used in cyberespionage intrusions. It supports host information collection, file deployment, command execution, and AES-encrypted command-and-control communications. It has been deployed on compromised Windows systems by Earth Krahang, a China-nexus espionage actor that has targeted government entities, particularly in Southeast Asia, through spear-phishing and exploitation of public-facing servers. A separate long-running intrusion cluster targeting a Southeast Asian government, assessed with moderate confidence as Alloy Taurus (GALLIUM), also used RESHELL alongside web shells and credential-access tooling. In that activity, attackers attempted to execute the backdoor after exploiting Microsoft Exchange Server vulnerabilities.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Earth Krahang was observed exploiting public-facing servers "to install backdoors such as Cobalt Strike, RESHELL, and XDealer." The advisory identifies RESHELL C&C servers.
Earth Krahang delivers backdoors to establish access to victim machines. Cobalt Strike and two custom backdoors, RESHELL and XDealer, were employed during the initial stage of attack.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Earth Krahang abuses the trust between governments to conduct their attacks. We found that the group frequently uses compromised government webservers to host their backdoors and send download links to other government entities via spear phishing emails.
The advisory identifies XDealer, RESHELL, Cobalt Strike, PlugX, and ShadowPad among campaign malware.
Listed in the Earth Krahang resource-development TTP table.
Since the malicious link uses a legitimate government domain of the compromised server, it will appear less suspicious to targets and may even bypass some domain blacklists.
Earth Krahang exploited Oracle Web Applications Desktop Integrator CVE-2022-21587 and OpenFire CVE-2023-32315.
Earth Krahang also makes use of spear phishing email to attack its targets... In one case, the actor used a compromised mailbox from a government entity to send a malicious attachment to 796 email addresses.
the group frequently uses compromised government webservers to host their backdoors and send download links to other government entities via spear phishing emails.
Maintaining backdoor persistence with task scheduling
the emails are intended trick their targets into opening attachments or embedded URL links that ultimately lead to the execution of a prepared backdoor file on the victim’s machine.
Maintaining backdoor persistence with task scheduling
Maintaining backdoor persistence with task scheduling
backdoor filenames are usually related to geopolitical topics... 'Plan of Action (POA) - TH-VN - TH_Counterdraft_as of Feb 2022.doc.exe'
The advisory identifies XDealer, RESHELL, and Cobalt Strike command-and-control servers and domains.
The campaign installed backdoors including Cobalt Strike, RESHELL, and XDealer on compromised servers.
its command-and-control (C&C) communication is encrypted with the AES algorithm.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.