Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
L’article constitue la première documentation publique de l’utilisation d’Xray-core comme mécanisme C2 par ce groupe. La configuration VLESS/REALITY utilisait le TLS serverName dl.google.com et un fingerprint TLS Chrome pour imiter du trafic légitime.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistance assurée via : Tâches planifiées (\GoogleChromeUpdateCore, \ConnectivityServiceAgent).
Persistance assurée via : Tâches planifiées (\GoogleChromeUpdateCore, \ConnectivityServiceAgent).
MITRE ATT&CK Current (ZSpeeding proxy phase) T1090.003 · T1205 · T1001.003 · T1571 · T1573
“[The beacon persisted] via a Run value which would execute a PowerShell script named updater.ps1 ... used to relaunch the tunnel.”
Persistance assurée via : Tâches planifiées (\GoogleChromeUpdateCore, \ConnectivityServiceAgent).
“[The beacon persisted] via a Run value which would execute a PowerShell script named updater.ps1 ... used to relaunch the tunnel.”
Xray-core ... renommé pour se fondre dans l’environnement : ChromeUpdate.exe ... ConnectivityHost.exe.
Timestomping des binaires du tunnel (timestamps uniformisés au 2026-01-01).
MITRE ATT&CK Current (ZSpeeding proxy phase) T1090.003 · T1205 · T1001.003 · T1571 · T1573
“The C2 tunnel itself carried WinRM sessions.”
configured to bypass the Great Firewall of China ... a custom-built Xray-core wrapper called ZSpeeding — a VLESS + REALITY + SOCKS4A + gRPC proxy stack impersonating DingTalk and Alibaba CDN via SNI spoofing
L’utilisation d’Xray-core ... comme mécanisme C2 ... La configuration VLESS/REALITY utilisait le TLS serverName dl.google.com.
MITRE ATT&CK Current (ZSpeeding proxy phase) T1090.003 · T1205 · T1001.003 · T1571 · T1573
MITRE ATT&CK Current (ZSpeeding proxy phase) T1090.003 · T1205 · T1001.003 · T1571 · T1573
La configuration VLESS/REALITY utilisait le TLS serverName dl.google.com et un fingerprint TLS Chrome pour imiter du trafic légitime.
“Aur0ra configured Xray to use browser-like TLS camouflage. The recovered VLESS/REALITY configuration set the TLS serverName to dl[.]google[.]com ... and selected a Chrome TLS fingerprint.”
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.