Loading malware…
NEWSREELS is a malware family referenced in Mandiant’s APT1 reporting and associated follow-on analysis. It is identified as one of multiple malicious programs used in the broader APT1 ecosystem, alongside tools such as GOGGLES, SWORD, and LONGRUN. High-confidence reporting links NEWSREELS to the same distinctive decoding method observed in those tools, including use of the string "thequickbrownfxjmpsvalzydg." In the imphash analysis derived from the Mandiant APT1 dataset, NEWSREELS was represented by at least two import-hash clusters: 3b10d6b16f135c366fc8e88cba49bc6c with 77 imports and 41 matched samples, and 4f0aca83dfe82b02bbecce448ce8be00 with 80 imports and 10 matched samples. These samples were part of malware analyzed from the February 2013 Mandiant APT1 report, and Mandiant stated that imphash pivoting helped identify additional related samples later assessed as belonging to the same malware families and attributable to the same threat group with further corroboration. The provided content does not describe a specific infection vector, persistence mechanism, or victim sector unique to NEWSREELS itself, but it places the malware within the APT1 toolset associated by Mandiant with China and possible PLA Unit 61398 activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This decoding method is mentioned in the Mandiant report multiple times, used by the GOGGLES malware as well as three other malicious programs (SWORD, NEWSREELS, and LONGRUN).
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.