Loading malware…
SLUB is a custom Windows backdoor associated with targeted espionage activity, including the Operation Earth Kitsune campaign and earlier North Korea-themed watering-hole operations. It has been linked in reporting to activity likely connected to APT37, also known as Reaper or Group 123, based on overlapping tradecraft, delivery patterns, code similarities, and developer-environment artifacts.
SLUB is typically delivered as a second-stage payload by an initial downloader executed through PowerShell after browser exploitation or watering-hole compromise. Observed delivery chains have used compromised Korea-related websites and exploits including CVE-2018-8174, CVE-2019-5782, CVE-2020-0674, and local privilege-escalation exploits such as CVE-2015-1701 and CVE-2019-1458. The malware and its loaders include checks for installed security products and may terminate execution when defensive software is detected, reflecting a strong emphasis on defense evasion.
The malware’s command-and-control design has evolved across variants. Early SLUB samples abused public cloud services, retrieving commands from GitHub Gist content and using Slack for operator communications and exfiltration. Later variants replaced Slack with attacker-controlled Mattermost infrastructure, including per-victim channels and notification channels for infection alerts. This progression preserved the same general model of blending command traffic with legitimate collaboration platforms while improving victim-specific tasking.
SLUB supports a broad set of post-compromise capabilities. Reported functions include arbitrary command execution, download-and-execute, self-update, self-deletion, screenshot capture, file listing and manipulation, directory creation and removal, process enumeration and termination, drive enumeration, and registry interaction. It has also been used to collect host context and exfiltrate user data, including documents and communications-related artifacts, indicating an intelligence-collection role rather than disruptive or financially motivated objectives. Some variants uploaded stolen files through third-party file-sharing services, while Mattermost-based versions exfiltrated command output and screenshots directly through the collaboration server.
Persistence has been established through Windows autorun mechanisms invoking the malware via rundll32, with installation under system-accessible directories and naming intended to resemble legitimate Windows components or updates. Across campaigns, operators showed recurring interest in Korean-language documents, bulletin-board content, desktop files, and communications data, suggesting targeting of individuals and organizations engaged with Korean political or social issues, including the global Korean diaspora.
SLUB is best characterized as a stealth-conscious espionage backdoor built for selective intrusions, modular delivery, and covert operator tasking over trusted web services or collaboration platforms.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
We previously wrote about the SLUB malware in 2019... In 2020, we found multiple instances of their attacks... delivering a new variant of the malware... During our investigation of the samples, we found one that was very similar to SLUB, but instead of using Slack, it used Mattermost... We considered this sample a new variant of SLUB.
We also found another exploit abusing CVE-2020-0674, an Internet Explorer vulnerability injected into compromised websites. In particular, it runs a PowerShell loader that will infect victims with three different binaries. | We previously wrote about the SLUB malware in 2019... In 2020, we found multiple instances of their attacks... delivering a new variant of the malware... During our investigation of the samples, we found one that was very similar to SLUB, but instead of using Slack, it used Mattermost... We considered this sample a new variant of SLUB.
The Chrome exploit involves chaining two vulnerabilities that have already been patched, with one assigned as CVE-2019-5782, while the other does not have an associated CVE identifier. The attacker reused the POC code to implement a weaponized version of it. | We previously wrote about the SLUB malware in 2019... In 2020, we found multiple instances of their attacks... delivering a new variant of the malware... During our investigation of the samples, we found one that was very similar to SLUB, but instead of using Slack, it used Mattermost... We considered this sample a new variant of SLUB.
The infection was done by exploiting CVE-2018-8174, a VBScript engine vulnerability that was patched by Microsoft back in May 2018.
Finally, the downloader also exploits the CVE-2015-1701 vulnerability to acquire Local Privilege Escalation. The exploit's code was likely created by modifying code from a GitHub repository.
If instructed in the LPE (Local Privilege Escalation) column, the PowerShell loader may instruct downloading and executing an LPE binary exploiting CVE-2019-1458. This binary may download and execute the backdoors with system privileges. | We previously wrote about the SLUB malware in 2019... In 2020, we found multiple instances of their attacks... delivering a new variant of the malware... During our investigation of the samples, we found one that was very similar to SLUB, but instead of using Slack, it used Mattermost... We considered this sample a new variant of SLUB.
"...one of the samples, the SLUB loader exploiting CVE-2019-0803, contained a version resource section that included intentionally misleading planted data."
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We previously wrote about the SLUB malware in 2019... In 2020, we found multiple instances of their attacks... delivering a new variant of the malware... During our investigation of the samples, we found one that was very similar to SLUB, but instead of using Slack, it used Mattermost... We considered this sample a new variant of SLUB.
"Previously, we uncovered two different campaigns in 2019 under the name of SLUB malware. Operation Earth Kitsune is a continuation of those campaigns."
31 distinct techniques documented for this family, organized by ATT&CK tactic.
the PowerShell loader may instruct downloading and executing an LPE binary exploiting CVE-2019-1458. This binary may download and execute the backdoors with system privileges.
Upon execution, the shellcode first de-obfuscates “ws2_32.dll” and “_.dll,” and then resolves the API modules based on their hashes using a known technique.
This PowerShell script has a “jpg” extension and its logic is encoded in base64
reg Query Query registry key Read Read registry key Write Write registry key
The attackers' first actions involve getting context information... ^exec,tasklist$
The commands that the attackers ran clearly show a strong interest in person-related information, with a special focus on communication software...
All communication uses HTTP on port 443. | The new SLUB variant interacts with the Mattermost server to keep track of the deployment across multiple infected machines.
HTTPS GET request... HTTPS POST request... HTTPS request Check for commands... HTTPS request Send results... HTTP request Check for new Slack token
the C&C communication happens to be with TCP at DNS standard port (53) to avoid being blocked by a firewall.
The objective of the SLUB samples was to exfiltrate a considerable amount of system information.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family used in 2019 campaigns and continued in Operation Earth Kitsune; includes components described as loader/dropper, with later versions supporting Mattermost-based C2 and used in multi-stage delivery and persistence.
A custom C++ backdoor delivered as a second-stage payload. It persists via a Run registry key and rundll32.exe, retrieves commands from a GitHub gist, and exfiltrates command output and screenshots to private Slack channels using embedded Slack API tokens. It supports command execution, file operations, screenshot capture, process management, registry access, and self-update/self-delete functions.
Backdoor family that abuses cloud services for C2 and exfiltration. Version 1 reads commands from GitHub Gists and uses Slack plus file.io for exfiltration; version 2 drops GitHub, creates victim-specific Slack channels, reads pinned messages as commands, uploads stolen files, and can fetch updated Slack tokens.
A backdoor used in Operation Earth Kitsune that evolved from using Slack/GitHub to using a self-hosted Mattermost server for C2. It creates per-victim channels, exfiltrates system information, executes reconnaissance commands, and captures screenshots from infected machines.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.