Loading malware…
IsSpace is a Windows backdoor associated with DragonOK activity and assessed to share code and behavioral lineage with the older NFlog backdoor. It has been observed in espionage-oriented intrusion campaigns targeting organizations and individuals in Japan and likely also Taiwan, Tibet, and Russia, including sectors such as manufacturing, higher education, energy, technology, and semiconductors. It has also been linked to a watering-hole operation against visitors to an aerospace-related website.
Observed delivery methods include phishing emails carrying malicious executables, malicious RTF documents exploiting CVE-2015-1641, and a watering-hole attack using a weaponized Adobe Flash exploit for CVE-2015-5122. In later DragonOK activity, IsSpace was delivered using techniques also used for Sysget and TidePool.
IsSpace performs host profiling and transmits victim metadata to command-and-control infrastructure. Reported collection includes operating system version, CPU architecture, hostname, language, timestamp, administrative status, MAC address, and internal and external IP information. It supports a typical backdoor command set including remote command execution, directory listing, file upload, file download, and file deletion. On some systems it also attempted to obtain Internet Explorer proxy authentication credentials, indicating credential access capability.
The malware incorporates defensive checks before full execution, including inspection for processes associated with security software. Network communications have used XOR-obfuscated HTTP POST data and structured URI-based command-and-control loops. Multiple reports note changes across variants in URI structure and installation routines while retaining the same overall command set.
Persistence and execution methods evolved over time. Earlier activity used DLL sideloading-related installation behavior, while later variants established persistence through PowerShell-driven creation of a user Run key entry. IsSpace has also attempted privilege escalation on certain Windows configurations through a sysprep-based DLL sideloading chain involving a malicious CryptBase component. These traits, together with its continued refinement and overlap with other DragonOK tooling, place IsSpace among the long-running espionage backdoors used in East Asia-focused intrusion operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Next: Watering Hole Attack on Aerospace Firm Exploits CVE-2015-5122 to Install IsSpace Backdoor
Sysget malware was delivered both directly via phishing emails, as well as in Rich Text Format (RTF) documents exploiting the CVE-2015-1641 vulnerability (patched in MS15-033) that in turn leveraged a very unique shellcode.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recent new reporting was released on the DragonOK group which unveiled the many versions of the Sysget backdoor as well as the IsSpace backdoor.
Upon further analysis, this file was found to contain behavior consistent with a Trojan commonly called IsSpace. Based on its codebase and behavioral patterns, it appears that IsSpace could possibly be an evolution of the NFlog backdoor.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
After the successful check-in and initial exfiltration, IsSpace will then accept the following commands: CMD Executes command
the installation routine for this malware family has been updated to be far less complex than previous discussed versions, favoring PowerShell to set persistence
Persistence is achieved through the setting of an ASEP after the RAT has been installed to a particular folder.
The ROR7 operation is a very common technique in shellcode to obfuscate what functions are being called. The author added the XOR operation to add another layer of obfuscation. ... all HTTP URIs in this version of sysget are encrypted.
Once uncompressed, a binary was found to be embedded in the Flash file.
It will first copy itself to the %LOCALAPPDATA% folder with a name of ‘bfsuc.exe’. ... sysget ... copying itself to the %STARTUP%/winlogon.exe path.
After the successful check-in and initial exfiltration, IsSpace will then accept the following commands: DelFile Delete file
To determine the flow of execution, IsSpace gathers various data about the infected host, such as administrative rights of the user, operating system version, and CPU architecture. | If the malware detects that it is running on a Windows XP host, it will attempt to check for Internet connectivity by making a HTTP request to www.microsoft.com.
To determine the flow of execution, IsSpace gathers various data about the infected host, such as administrative rights of the user
IsSpace proceeds to iterate over the running processes on the system, seeking out the following two process substrings
The ‘Sennw.asp’ POST requests that are made contain collected victim information. ... MAC address ... External IP ... Internal IP address ... Hostname ... Windows version ... Language ... Timestamp ... User admin status
goto wrong "[file_path]"; Read a specific file and return its contents. ... Browse List specified directory
To determine the flow of execution, IsSpace gathers various data about the infected host, such as administrative rights of the user, operating system version, and CPU architecture. | If the malware detects that it is running on a Windows XP host, it will attempt to check for Internet connectivity by making a HTTP request to www.microsoft.com.
The POST data sent in this request is encrypted using the same four-byte XOR key of '\x35\x8E\x9D\x7A' that has been used by the NFlog tool.
The primary C2 server communicates over port 80. Alternate ports are configurable through the secondary C2 server variable.
The malware then makes an initial HTTP POST request to the configured C2 server. ... Sysget proceeds to enter its command and control loop. An HTTP request such as the following is made to the remote server.
This new variant also incorporates the use of the Google App Engine (GAE) hosting to proxy communications to its C2 Server.
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An evolved variant of the NFlog backdoor used by DragonOK. It installs as bfsuc.exe, sets persistence via PowerShell registry Run key, beacons to C2 over XOR-obfuscated HTTP, collects host/network details, and supports command execution, directory browsing, file upload/download, and file deletion.
A trojan/backdoor delivered via a weaponized Adobe Flash exploit for CVE-2015-5122. It establishes a foothold on victim machines, performs host reconnaissance, exfiltrates system information, communicates with a hardcoded HTTP C2, and supports commands to execute commands, browse directories, upload/download files, and delete files. It also uses privilege-escalation/side-loading techniques involving sysprep and CryptBase.dll.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.