nccTrojan

nccTrojan, also referred to as MsmRAT, is a Windows remote access trojan associated with the China-linked espionage group TA428, also tracked as Vicious Panda or BRONZE DUDLEY. It has been observed in Operation LagTime IT and in intrusions targeting government, defense, and aviation-related organizations in East Asia, including Mongolia and Russia. The malware appears to have been under active development, with at least two major branches, commonly described as v1 and v2, that differ substantially in implementation and deployment stage.

nccTrojan provides typical RAT functionality for post-compromise control. Reported capabilities include remote shell access, operating-system command execution, disk and host information collection, file and directory enumeration, file upload and download, file copy and move operations, file and folder deletion, process listing, and process termination. Version 1 used a simpler command-and-control scheme with XOR-obfuscated traffic, while version 2 used a custom TCP protocol with AES-encrypted payloads and an activation mechanism that enabled command handling only after receipt of a specific operator-supplied code.

The malware has been observed primarily as a later-stage payload in TA428 intrusions after internal compromise and lateral movement. In Operation LagTime IT, TA428 used Royal Road-generated lure documents exploiting CVE-2018-0798 to deploy earlier-stage malware such as Poison Ivy and Cotx RAT, followed by credential theft, network reconnaissance, and MS17-010-based lateral movement. After privilege acquisition on internal hosts, nccTrojan v2 was installed as a Windows service by an installer component and executed through a service-hosting process, providing persistence and durable remote access. Separate reporting also indicates that version 1 could be used earlier in the intrusion chain, including in attacks delivered through Royal Road weaponized documents.

nccTrojan is part of a broader TA428 toolset that has included Poison Ivy, Cotx RAT, Tmanger, and Royal Road. Its observed use aligns with long-running Chinese cyber-espionage activity focused on governmental and strategic-sector targets. The malware’s service-based persistence, encrypted command channel, and broad remote administration feature set make it suitable for sustained post-exploitation operations inside compromised Windows environments.