Winnti Linked to PortReuse Backdoor and Multiple Software Supply-Chain Breaches

ESET reported that the Winnti Group used a previously unanalyzed passive backdoor called PortReuse and tied it to a broader malware arsenal that also includes updated ShadowPad variants and a VMProtect-based launcher. PortReuse injects into processes already listening on common ports, waits for a magic packet, and covertly enables attacker control while forwarding legitimate traffic, helping it blend into normal network activity. The launcher decrypts either PortReuse or ShadowPad payloads with RC5 keys derived from the victim machine’s volume serial number, a technique ESET said reinforced the technical links across the toolset.

The research connected multiple high-profile software supply-chain compromises—including CCleaner, NetSarang, Asus ShadowHammer, and several 2018 compromised games and software incidents—to the same broader Winnti ecosystem through shared tooling, cryptography, and tradecraft. ESET also said some of the 2018 third-stage payloads were XMRig Monero miners, indicating cryptocurrency mining as one operational objective. With assistance from Censys, the company identified eight Internet-facing systems matching PortReuse’s HTTP signature at a major Asian mobile hardware and software manufacturer and said it notified the victim.