Loading story…
Trend Micro researchers reported that the Chinese-speaking threat actor Earth Lusca used a previously undocumented Golang backdoor called KTLVdoor in a broad intrusion campaign targeting both Windows and Linux systems. The malware was designed for stealth, often disguising itself as legitimate system utilities while giving operators extensive remote access, including command execution, file management, proxying, and port scanning. Investigators identified at least one victim, a trading company in China.
KTLVdoor uses a custom TLV-like configuration format with encrypted values and protects command-and-control traffic with GZIP and AES-GCM, complicating analysis and detection. Researchers tied the activity to more than 50 command-and-control servers hosted on Alibaba infrastructure in China, but said attribution across the full server set remains uncertain because some tooling or infrastructure may be shared with other Chinese-speaking threat actors.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro publicly disclosed KTLVdoor and described its obfuscation, custom TLV-like configuration format, encrypted communications, and broad remote access capabilities including command execution, file operations, proxying, and port scanning.
Researchers found more than 50 command-and-control servers communicating with KTLVdoor variants, all hosted on Alibaba infrastructure in China. They also identified at least one target of the operation: a trading company based in China.
While monitoring the Chinese-speaking threat actor Earth Lusca, researchers identified a previously unreported Golang backdoor named KTLVdoor with Windows and Linux variants. They tied some samples to Earth Lusca with high confidence, while noting the broader infrastructure may also be shared with other Chinese-speaking actors.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked threat actor **Earth Lusca** expanded its operations globally while continuing to concentrate on Southeast Asia, Central Asia, and the Balkans, according to Trend Micro. Researchers recovered and decrypted a previously unseen Linux backdoor dubbed **SprySOCKS** from the group’s delivery infrastructure, linking it to campaigns targeting government departments involved in foreign affairs as well as organizations in the technology and telecommunications sectors. Trend Micro said SprySOCKS appears to be a Linux adaptation of the open-source Windows backdoor **Trochilus**, with an interactive shell resembling **Linux Derusbi** and a command-and-control protocol similar to **RedLeaves RAT**. The malware uses a two-part architecture consisting of a loader and an encrypted main payload, and multiple version markers indicate it remains under active development. Investigators also observed Earth Lusca using **Cobalt Strike** for lateral movement and aggressively exploiting public-facing servers through server-side **N-day vulnerabilities** to gain access.
Jun 29, 2026
Trend Micro reported that the China-aligned threat group **Earth Lusca** targeted organizations in Taiwan with politically themed social-engineering lures tied to cross-strait tensions and the island’s election period. The campaign used documents and decoy content crafted to appear relevant to current geopolitical developments, aiming to entice victims into opening malicious files and initiating compromise. The activity was attributed to a broader cyber-espionage effort focused on Taiwan, with the attackers seeking access to targeted environments for intelligence collection. Trend Micro said the operation reflected Earth Lusca’s established pattern of using timely regional issues to improve phishing success and maintain persistent access against government and other organizations of strategic interest.
Jul 12, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026