Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Modular ChonkyChicken represents a significant architectural departure from earlier TAG-195 malware... a dedicated controller implant responsible for WebSocket communications, host registration, task routing, and module lifecycle management, while operational capabilities are delivered via discrete plugins retrieved from C2 infrastructure as needed.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
"tiny" shell_start shell_input shell_output ... cmd.exe powershell.exe wscript.exe cscript.exe mshta.exe
Every component is delivered as an OCX file and executed via regsvr32.exe (a legitimate Windows binary)
ChonkyChicken retains a Web Proxy Auto-Discovery (WPAD) helper workflow that, when operational, positions the implant as a network proxy capable of intercepting victim network traffic.
The net_enumerate workflow combines ARP discovery, NetBIOS resolution, TCP scanning, and SMB enumeration into a single operation, returning IP address, MAC address, hostname, fully qualified domain name, domain name, operating system, and open ports.
ChonkyChicken retains a Web Proxy Auto-Discovery (WPAD) helper workflow that, when operational, positions the implant as a network proxy capable of intercepting victim network traffic.
WebSocket-based C2 using a JSON-formatted, task-driven protocol
When a required module is not present on the host, the controller sends a module_request message to C2. The returned module is Base64-decoded, written to a randomly named temporary file, and loaded into memory through LoadLibraryA.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.