Loading story…
ESET reported that the Winnti Group used a previously unanalyzed passive backdoor called PortReuse and tied it to a broader malware arsenal that also includes updated ShadowPad variants and a VMProtect-based launcher. PortReuse injects into processes already listening on common ports, waits for a magic packet, and covertly enables attacker control while forwarding legitimate traffic, helping it blend into normal network activity. The launcher decrypts either PortReuse or ShadowPad payloads with RC5 keys derived from the victim machine’s volume serial number, a technique ESET said reinforced the technical links across the toolset.
The research connected multiple high-profile software supply-chain compromises—including CCleaner, NetSarang, Asus ShadowHammer, and several 2018 compromised games and software incidents—to the same broader Winnti ecosystem through shared tooling, cryptography, and tradecraft. ESET also said some of the 2018 third-stage payloads were XMRig Monero miners, indicating cryptocurrency mining as one operational objective. With assistance from Censys, the company identified eight Internet-facing systems matching PortReuse’s HTTP signature at a major Asian mobile hardware and software manufacturer and said it notified the victim.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
In its October 2019 white paper, ESET analyzed the Winnti Group's malware arsenal, documented the PortReuse backdoor, and assessed that strong technical links connected the CCleaner, NetSarang, Asus ShadowHammer, and 2018 compromised games/software incidents to the same broader Winnti ecosystem.
ESET observed that ShadowPad was still being updated and used multiple times in 2019, including variants with random module IDs and additional obfuscation. The report also noted ShadowPad samples retrieving encrypted C2 information from public services such as Google Docs, Steam Community, GitHub, Pastebin, and MSDN profiles.
ESET reported that decrypted third-stage payloads from 2018 compromised games and software supply-chain attacks were XMRig Monero miners, indicating cryptocurrency mining as one objective of the operators.
After identifying the exposed systems, ESET notified the affected Asian mobile hardware and software manufacturer and worked with it on remediation.
With help from Censys, ESET identified eight Internet-facing systems matching PortReuse's HTTP signature and determined they all belonged to a major Asian mobile hardware and software manufacturer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourceattack.mitre.org
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and incident responders have tied a broad set of espionage and intrusion activity to the **Winnti** ecosystem, a China-linked threat cluster active for years against gaming companies, software vendors, and enterprise networks worldwide. Early reporting described intrusions used to steal source code, digital certificates, and other intellectual property, while later investigations connected the same ecosystem to major supply-chain compromises including **CCleaner**, **NetSarang**, **ShadowHammer**, and other software incidents. Researchers also found evidence that some operations monetized access through cryptocurrency mining and in-game fraud, and that operators tailored malware configurations to specific victims and campaigns. Technical analysis shows Winnti operators evolving their tooling and infrastructure with modular backdoors such as **PortReuse**, **ShadowPad**, and newer malware linked with moderate confidence such as **Glutton**, while continuing to hide command-and-control through methods including GitHub-hosted encrypted C2 data, passive backdoors on common service ports, and rootkit-assisted traffic rerouting via **NdisReroute**. Defenders published multiple ways to detect the threat, including YARA rules, configuration parsers, PCAP and live-network detectors for the distinctive Winnti `HELO` handshake, Nmap scripts that can identify infected hosts and extract host metadata, and internet-scale tracking of **Winnti 4.0** and ShadowPad servers. VMware reported dozens of active Winnti 4.0 servers still online, underscoring that the malware family’s infrastructure remains persistent and operational.
Aug 15, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Rapid7 disclosed a targeted malware campaign using a new installer dubbed **CleverSoar** to infect Chinese- and Vietnamese-speaking Windows users with the **Winos4.0** framework, the **Nidhogg** rootkit, and a custom backdoor. The installer performs extensive anti-analysis and targeting checks before execution, including VM and debugger detection, sandbox-user validation, and **system language discovery** consistent with MITRE ATT&CK `T1614.001`, then escalates privileges, disables security tools, turns off the Windows firewall, installs persistence, and hides artifacts. Rapid7 said the activity appears aligned with a long-running espionage effort focused on surveillance, keystroke logging, data theft, and covert remote control. The findings overlap with Fortinet reporting on malware operations aimed at Chinese-speaking users, including a **Winos4.0** campaign spread through trojanized gaming utilities and a separate **ValleyRAT** intrusion set attributed to the suspected **Silver Fox** group. Fortinet said Winos4.0 is a modular framework rebuilt from **Gh0st RAT** that uses staged loaders, shellcode injection, registry-stored modules, and persistence via Run keys or scheduled tasks, while plugins enabled screenshot capture, document theft, clipboard monitoring, and searches for crypto-wallet browser extensions. Rapid7 assessed with medium confidence that CleverSoar may be linked to the same actor behind Fortinet's ValleyRAT-related activity, citing shared tradecraft such as in-memory execution, anti-VM checks, privilege escalation, and evasion tailored to regional security products.
Aug 15, 2026