CloudComputating Deployed QSC In-Memory Framework in Telecom and ISP Intrusions

Researchers linked intrusions at telecom organizations in South Asia and an ISP in West Asia to CloudComputating—also tracked as BackdoorDiplomacy and Faking Dragon—after uncovering a new modular malware framework called QSC. The framework was delivered through Quarian v3 (also known as Turian) and consists of Loader, Core, Network, Command Shell, and File Manager components designed to keep most functionality in memory. In a later campaign, the attackers also deployed a new Golang backdoor, GoClient, to execute commands, manage files, capture screenshots, and conduct post-compromise reconnaissance.

The operators used QSC and GoClient to enumerate compromised environments, identify domain controllers and file servers, steal NTDS.dit using shadow copies, and move laterally with WMIC and stolen domain administrator credentials. Researchers said the activity showed a tactical shift toward a plugin-based framework with internal pivoting and port-forwarding to route command-and-control traffic through compromised hosts. The attribution to CloudComputating was made with medium confidence based on Quarian infrastructure, malware overlaps, shared tooling, and consistent operational patterns.