Loading malware…
Zupdax is a modular Windows remote access trojan active since at least early 2014 and used in cyberespionage operations. It collects host information, downloads and executes plugins, and supports updating and removing itself. Its command-and-control communications use the UDT library over UDP; some configurations disguise this traffic as DNS communications. Zupdax commonly executes through DLL side-loading, including abuse of a legitimate McAfee SiteAdvisor executable. Modern variants use loading components closely matching those used by MyKLoadClient. Its network-message structures, command identifiers, debug messages, and plugin architecture share similarities with the older Redsip backdoor.
Zupdax has been associated with both PKPLUG activity and the Space Pirates toolkit, but it is not uniquely attributable to either threat cluster. It was deployed during the 2019–2020 Vatican intrusions and has also been identified in compromised Able Desktop software installers targeting organizations in Mongolia. Shared infrastructure connects it with other espionage malware, including Poison Ivy, HenBox, and Farseer, without establishing common ownership or exclusive attribution.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The criminals also have access to the Zupdax backdoor: its modern variants use a similar MyKLoadClient execution scheme.
The criminals also have access to the Zupdax backdoor: its modern variants use a similar MyKLoadClient execution scheme.
Злоумышленники также имеют доступ к бэкдору Zupdax: его современные варианты используют аналогичную MyKLoadClient схему исполнения, однако код самого бэкдора берет начало в 2010 году и не может быть однозначно привязан к группе.
Злоумышленники также имеют доступ к бэкдору Zupdax: его современные варианты используют аналогичную MyKLoadClient схему исполнения, однако код самого бэкдора берет начало в 2010 году и не может быть однозначно привязан к группе.
Злоумышленники также имеют доступ к бэкдору Zupdax: его современные варианты используют аналогичную MyKLoadClient схему исполнения, однако код самого бэкдора берет начало в 2010 году и не может быть однозначно привязан к группе.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Группа Space Pirates создает вредоносные сервисы
PlugX is usually distributed as a package of several files. These files are composed to exploit a phenomenon called DLL search order hijacking (also called sideloading)... The malware thus gets the unwitting help of a trusted executable to run.
InsertS: create a service named Network Service.
Install loader exe in registry run key and load payload... Alternatively, a shortcut file - “Internet Explorer.lnk” - with the same function may be placed in the %STARTUP% folder.
InsertS: create a service named Network Service.
Install loader exe in registry run key and load payload... Alternatively, a shortcut file - “Internet Explorer.lnk” - with the same function may be placed in the %STARTUP% folder.
Three well-known methods using sdclt.exe, a .NET library, and mocking trusted directories have been implemented.
Группа Space Pirates маскирует свое ВПО под легитимное ПО
Space Pirates malware uses various algorithms to encrypt configuration data and payload.
PlugX is usually distributed as a package of several files. These files are composed to exploit a phenomenon called DLL search order hijacking (also called sideloading)... The malware thus gets the unwitting help of a trusted executable to run.
Space Pirates malware uses reflective loading to run payloads in memory.
Space Pirates uses stolen certificates to sign some Zupdax samples.
Space Pirates collects information about the network settings of the infected machine.
Space Pirates collects information about users of compromised computers.
The backdoor collects and sends information about the system, including the computer name, user name, OS version, information about disk volume, RAM, and CPU.
Data transferred is encrypted using RC4 with the encryption key “Microsoft”... Network traffic is LZ-compressed and base64 encoded... usernames and passwords are encrypted and base64 encoded.
ВПО группы Space Pirates поддерживает работу с несколькими C2 и может обновлять список C2 через веб-страницы
Once installed, the main payload connects back to C2 server and sets up communication... It is installed as a service in the Windows System folder, and when run, it sets up communication with C2 server over HTTP.
The malware will in some configurations try to disguise this as legitimate traffic by connecting to port 53 (DNS) on the command & control server, as well as deliberately naming the C2 domains with the ns* (nameserver) prefix.
Space Pirates malware uses its own protocols to communicate with the C2 server.
Space Pirates downloads additional utilities from the C2 server using the certutil tool.
77 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.