Loading story…
Cybereason reported that ShadowWali is a newly analyzed variant in the xxmm backdoor family, a malware set linked to long-running intrusions against Japanese organizations and assessed as either an earlier form of Wali or a closely related sibling developed by the same author, identified as "123". The malware continues the family’s tradecraft of using unusually large binaries, process injection, compromised Japanese websites for command-and-control, and follow-on tooling for reconnaissance and credential theft, while introducing distinct behavior such as process hollowing into explorer.exe or LSASS.exe and steganography-based payload delivery through image files. Researchers also described an xxmm builder that can generate 32-bit and 64-bit payloads, configure persistence, and support PHP tunnel communications.
Technical details from prior JPCERT/JSAC analysis show the broader xxmm remote access trojan, also known as Minzen and associated with BRONZE BUTLER, supports command-and-control over HTTP, TCP, UDP, and ICMP and protects traffic with custom Base64 encoding, LZNT1 compression, and RC4 or RSA-wrapped session keys. The malware exposes a full remote administration feature set, including file operations, remote shell access, PowerShell execution, process creation, and plugin-based post-compromise activity, and has been observed using Mimikatz for credential dumping. Together, the reports indicate that Wali and ShadowWali remain active and capable backdoors designed for stealthy persistence, credential access, and lateral movement inside Japanese victim environments.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
A JPCERT/JSAC presentation in 2019 analyzed xxmm/Minzen, detailing its installer, encrypted resources, hardcoded configuration, and command-and-control over HTTP/S, TCP, UDP, and ICMP. It also described capabilities such as file operations, remote shell, PowerShell execution, and process creation.
The JPCERT/JSAC presentation assessed the BRONZE BUTLER threat actor as seemingly inactive since early 2018. The same presentation linked xxmm, also known as Minzen, to BRONZE BUTLER operations.
The JPCERT/JSAC presentation noted that several Datper variants were observed from November 2017. It said these variants changed to use a modified RC4 initialization.
Cybereason said the xxmm backdoor family has targeted Japanese businesses and organizations since 2015. The activity included use of large binaries, compromised Japanese websites for command-and-control, and payloads for reconnaissance and credential theft.
Cybereason reported that the xxmm builder sample xxmm2_build.exe was compiled in January 2015. The builder supported features including persistence options, process injection targets, PHP tunnel communications, and steganography-based payload hiding in image files.
Cybereason found an xxmm payload in scommand.txt on a compromised Japanese website and decrypted it to rr2E9E.tmp. The decrypted payload's PDB path pointed to the shadowWalker project, supporting the ShadowWali linkage.
Cybereason analyzed ShadowWali as a member of the xxmm backdoor family and assessed it as either an earlier version of Wali or a closely related sibling. The report also linked ShadowWali and Wali to the same developer identified as user "123" through PDB paths.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
Researchers reported a cyber-espionage campaign using the **ShadowPad** backdoor against industrial control system operators, telecommunications providers, and government-linked organizations in Pakistan, Afghanistan, Malaysia, and later Argentina-linked victimology. In several intrusions, attackers gained initial access through Microsoft Exchange Server exploitation tied to **`CVE-2021-26855`**, while another cluster used trojanized MSI installers for Pakistan government eOffice software to deliver a malicious **`mscoree.dll`** loader and encrypted payloads under **SYSTEM** privileges. Kaspersky said the activity began around March 2021 and assessed with high confidence that a Chinese-speaking threat actor was responsible, though it stopped short of a definitive link to **HAFNIUM**; Trend Micro likewise found overlaps with previously reported China-linked ShadowPad activity but said attribution remained inconclusive. The intrusions relied on multiple execution and persistence methods, including launching ShadowPad through the legitimate **AppLaunch.exe**, DLL hijacking via **OleView** with **`IVIEWERS.dll`** and **`IVIEWERS.dll.dat`**, and web-shell access consistent with tooling such as **China Chopper**. Post-compromise operations included credential theft, lateral movement, scheduled tasks, **Cobalt Strike**, **PlugX**, **Mimikatz**, **procdump**, **Nextnet** scanning, RAR archiving, and data exfiltration over **BITS**, indicating a sustained effort to harvest sensitive information from strategically important networks.
Aug 14, 2026