Loading malware…
Tmanger is a Windows remote access trojan associated primarily with the TA428 intrusion cluster and documented in espionage operations targeting East Asian organizations, including government entities, with additional observed use in Mongolia and through the Able Desktop supply-chain compromise. It has also been linked in reporting to broader LuckyMouse-related tooling overlaps, though direct attribution beyond TA428 is not uniformly established.
Tmanger is a modular RAT composed of setup, loader, and client stages commonly referred to as SetUp, MloadDll, and Client. The setup stage checks privilege level and establishes persistence differently depending on whether it has administrative rights. In elevated contexts it installs the loader as a Windows service; in lower-privilege contexts it copies itself for user-level persistence via autorun mechanisms. The loader stage exports functions including the distinctive misspelled names Entery and ServiceMain, decrypts embedded configuration data, extracts command-and-control information, and loads the client component. The client stage performs host profiling and maintains command-and-control communications using RC4-encrypted traffic.
Observed capabilities include host information collection, remote command execution including shell and PowerShell execution, directory and file management, file exfiltration, file writing and copying, file deletion, screen capture, and keylogging. Tmanger also uses anti-duplication logic through named events or mutex-like mechanisms. In intrusion chains, it has been deployed after initial compromise and lateral movement, including in Operation LagTime IT where TA428 used Royal Road-delivered lures, Poison Ivy, Cotx RAT, credential theft tools, and MS17-010 exploitation before installing Tmanger on internal hosts.
Tmanger has been observed as a later-stage implant rather than a primary initial-access payload. Delivery has occurred through compromised software distribution and update channels, notably trojanized Able Desktop installers and a likely compromised update mechanism, as well as post-compromise deployment by other malware already resident in victim environments. Research also places Tmanger in a broader malware lineage with Smanager, PhantomNet, and Albaniiutas, which share structural and code-level similarities such as staged architecture, export naming, configuration handling, and plugin-style loading behavior. Multiple versions have been observed, indicating continued development over time.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
Used a tool to exploit MS17-010 for lateral movement ... and new RATs such as Tmanger or nccTrojan
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA428 was also particularly active, using PoisonIvy, Cotx RAT, Tmanger, and nccTrojan to attack East Asian organizations such as Mongolia.
TmangerにはAlbaniiutas以外にも、類似したマルウェアが存在します。今回は私達がTmangerの亜種であると考えているSmanagerについて紹介します。
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The researchers noted that the malware’s persistence was established via a scheduled task that called the malicious DLL’s export, ‘Entery’.
As a result of our analysis, we consider that the functions of this RAT are as follows: • Command execution by PowerShell
As a result of our analysis, we consider that the functions of this RAT are as follows: • Command execution by PowerShell
Royal Road is a tool that generates RTF files that exploit the Microsoft Office Equation Editor vulnerabilities (CVE-2017-11882, CVE-2018-0798, CVE-2018-0802).
ServiceMain takes a service name as an argument and attempts to register a service control handler with a specific HandlerProc function meant to check and set the status of that service. With a valid service status handle, Mail-O detaches the calling process from its console, changes the service status values to reflect its current running state, and calls the Entery function.
Poison Ivy C&C Communication ... Tmanger C&C Communication ... nccTrojan C&C Communication
nccTrojan has following functions: ➢Download File (Read File) ➢Upload Files
60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor/payload delivered in later phases of Operation StealthyTrident alongside HyperBro and PlugX.
Malware noted for sharing the unusual exported function name 'Entery' and overlapping function layout/strings with Mail-O, and correlated in the content with TA428.
Related malware noted for sharing the distinctive misspelled export name 'Entery' and overlapping function layout/strings with Mail-O, used as part of the attribution linkage to TA428.
A LuckyMouse-associated implant mentioned only as historical context from an earlier campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.