Loading malware…
TencShell is a Go-based remote-access backdoor derived from the open-source Rshell command-and-control framework. Identified during an attempted intrusion in April 2026 and publicly documented in May 2026, it was deployed against the Indian branch of a multinational manufacturing company through abused trusted third-party access. The initial infection vector was not established. The activity has been assessed as suspected China-linked, without definitive attribution to a named threat group.
TencShell provides remote command execution, process enumeration, file browsing and transfer, screen capture and live streaming, and keyboard and mouse control. It supports in-memory assembly and binary execution, BOF-style modules, SOCKS5 proxying, and multiplexed tunneling. Browser-access routines can read or clear saved login data, cookies, and sessions from Google Chrome and Microsoft Edge, enabling credential theft and session hijacking. It also includes UAC bypass, Windows Registry autorun persistence, and self-deletion capabilities.
The observed delivery chain used a first-stage dropper to retrieve Donut shellcode disguised as a web-font resource. Donut reflectively mapped TencShell into memory within the originating process; no cross-process injection was observed. Its command-and-control communications imitate Tencent-style web-service APIs to blend into ordinary network traffic and support WebSocket communications. Infrastructure associated with TencShell was subsequently linked to a broader cyberespionage operation targeting government, manufacturing, and financial organizations that used Claude Code and DeepSeek to assist operational workflows.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack was intercepted at the company’s India site and traced back to a third-party user with a legitimate connection to the customer’s internal environment. Attackers exploited that trusted access as a bridge, effectively turning a routine business relationship into a dangerous and highly capable entry point.
The initial infection vector remains unknown but likely involved phishing, a malicious download, or another web-based delivery method.
0x0B EXECUTE_COMMAND Execute system command... 0x17 INTERACTIVE_SHELL Launch shell session
If successful, TencShell could have given the attacker remote command execution, in-memory payload execution, proxying, pivoting, system profiling, and a path to deploy additional tooling.
During execution, TencShell invokes Windows Registry APIs through Go runtime wrappers to access and modify registry values.
execute-assembly_windows.go Run .NET assemblies from memory... 0x2C DLL_LOAD Load DLL payload
A lightweight first-stage dropper was executed after initial access, designed to stay small and quietly pull down the next payload
persistence through a registry run key disguised as “OneDriveHealthTask,” TencShell is built for long-term, stealthy access rather than a quick smash-and-grab.
After retrieval, the shellcode was loaded into a memory region, marked as executable, and launched through a new thread within the originating process.
persistence through a registry run key disguised as “OneDriveHealthTask,” TencShell is built for long-term, stealthy access rather than a quick smash-and-grab.
A UAC bypass module, documented under the opcode UAC_BYPASS, allows the attacker to gain elevated privileges without triggering the standard Windows security prompt.
Their investigation revealed a carefully constructed attack chain involving staged payloads, masqueraded file types, and command-and-control communication specifically designed to blend into normal web traffic.
The dropper then retrieved what appeared to be a standard web font file with a .woff extension, the kind websites routinely use to load custom typefaces. Inside that file was Donut shellcode
The next stage involved retrieving Donut shellcode through a masqueraded .woff resource... By placing malicious content behind a font-looking path or extension, the attacker makes the payload request appear like a routine static web asset.
After retrieval, the shellcode was loaded into a memory region, marked as executable, and launched through a new thread within the originating process.
0x1B SELF_DELETE Remove implant from disk
AZUREVEIL supports 36 commands that allow it to perform a wide range of post-compromise actions on the host, including ... in-memory execution of Beacon Object Files (BOFs).
Functions like SendInput, MouseClick, KeyTap, and GetScreenWebSocket were all embedded within the tool, giving an operator direct interactive control of an infected host.
Recovered opcodes confirm operations for reading and clearing saved sessions, login data, and cookies from both browsers. This creates a direct path to credential theft and session hijacking
The implant also includes dedicated routines for accessing browser artifacts from both Chrome and Microsoft Edge. Recovered opcodes confirm operations for reading and clearing saved sessions, login data, and cookies from both browsers.
0x0C PROCESS_ENUMERATION Enumerate running processes
If successful, TencShell could have given the attacker remote command execution, in-memory payload execution, proxying, pivoting, system profiling, and a path to deploy additional tooling.
0x0A FILE_BROWSE Browse/list filesystem contents
If successful, TencShell could have given the attacker remote command execution, in-memory payload execution, proxying, pivoting, system profiling, and a path to deploy additional tooling.
0x13 READ_FILE_CONTENT Read/extract file contents
Functions like SendInput, MouseClick, KeyTap, and GetScreenWebSocket were all embedded within the tool, giving an operator direct interactive control of an infected host.
Recovered code modules confirm that the implant supports screen capture, live screen streaming over WebSocket, and real-time keyboard and mouse simulation.
The operation uncovered by Hunt researchers pivoted off known TencShell command-and-control (C2) infrastructure originally documented by Cato CTRL in May 2026.
TencShell used web-like communication patterns designed to make malicious traffic harder to distinguish from normal application traffic.
AZUREVEIL supports 36 commands that allow it to perform a wide range of post-compromise actions on the host, including ... port forwarding, SOCKS proxy control...
pkg/services/proxy/socks5.go Proxy traffic through the compromised host... pkg/services/proxy/mux/ Multiplex traffic for tunneling or pivoting
Combined with SOCKS5 proxying, DLL loading, file transfer, and persistence through a registry run key disguised as “OneDriveHealthTask,” TencShell is built for long-term, stealthy access
Some of the observed C2 paths used Tencent-like naming... This type of naming can help attacker-controlled traffic blend into normal web/API activity.
A lightweight first-stage dropper was executed after initial access, designed to stay small and quietly pull down the next payload
The repeated use of similar URI structures and ports across attacker-controlled infrastructure suggests a broader operational setup.
The communication package includes functions for pulling commands, pushing results... structured C2 reporting
91 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.