Loading malware…
ReverseWindow is a Windows malware family associated with the PRC-linked espionage actor LuoYu. It has been observed in overlap with infrastructure identified as ShadowPad command-and-control, indicating operational ties within the broader Chinese cyber-espionage ecosystem. Public reporting places ReverseWindow alongside other long-lived espionage malware used by China-linked operators, and it has been referenced together with WinDealer in activity attributed to LuoYu. High-confidence public facts in this context establish ReverseWindow as malware used in targeted espionage operations and show it communicating with command-and-control infrastructure over a custom TCP service. No more specific, well-corroborated functional classification or delivery mechanism is directly established here beyond its role as an espionage backdoor-like implant communicating with remote control infrastructure on Windows systems.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Spyder and ReverseWindow are APT malware utilized by PRC-linked cyber espionage threat actors (respectively APT41 and LuoYu).
1 distinct technique documented for this family, organized by ATT&CK tactic.
Tracking the entire iceberg - long-term APT malware C2 protocol emulation and scanning
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.